Wonshtrum
commented
3 weeks ago I will look into the certificates problem tomorrow, for now, I can only tell you that frontends have a certificate and certificate_chain fields, and it looks like you put the fullchain on certificate. It may not be enough to explain your problem though.
Unfortunately, http2 is not yet supported in the stable release of Sozu, but we are working on it. If you really need http2 (for forwarding grpc for example) you can try the 1.1.0-rc.2, or the latest commit on the development branch.
I dont know if this was related with sozu but, Im using nodejs to display images that proxied using sozu, i have generate valid cert using certbot and verify everything is working. But when i want to render/display images from my proxied domain that uses sozu, i got certficate error, sometimes i got ssl handshake failed when im trying to upload files.
I got this log from my node console
[cause]: Error: unable to verify the first certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1685:34) at TLSSocket.emit (node:events:519:28) at TLSSocket._finishInit (node:_tls_wrap:1085:8) at ssl.onhandshakedone (node:_tls_wrap:871:12) at TLSWrap.callbackTrampoline (node:internal/async_hooks:130:17) { code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' }I know its not about sozu but its related with the cert required for ssl when using sozu with https. When i try images proxied from nginx + letsencrypt, it is working fine. I dont know what to adjust, or maybe i generate wrong cert?
My config
saved_state = "./state.json" log_level = "info" log_target = "stdout" handle_process_affinity = true worker_automatic_restart = true activate_listeners = true
[[listeners]] protocol = "http" address = "0.0.0.0:80"
[[listeners]] protocol = "https" address = "0.0.0.0:443"
tls_versions = ["TLS_V12", "TLS_V13"] cipher_list = [ "TLS13_AES_256_GCM_SHA384", "TLS13_AES_128_GCM_SHA256", "TLS13_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", ]
[clusters]
[clusters.Site]
protocol = "http" send_proxy = true https_redirect = true
frontends = [ { address ="0.0.0.0:80", hostname = "domain.site" }, { address = "0.0.0.0:443", hostname = "domain.site", certificate = "/etc/letsencrypt/live/domain.site/fullchain.pem", key = "/etc/letsencrypt/live/domain.site/privkey.pem" }, ]
backends = [ { address = "127.0.0.1:2321" } ]
Is it possible to have http2 enabled too?