You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Fernando Serboncini 60acd0fedd ipn/ipnlocal: add wildcard TLS certificate support for subdomains
When the NodeAttrDNSSubdomainResolve capability is present, enable
wildcard certificate issuance to cover all single-level subdomains
of a node's CertDomain.

Without the capability, only exact CertDomain matches are allowed,
so node.ts.net yields a cert for node.ts.net. With the capability,
we now generate wildcard certificates. Wildcard certs include both
the wildcard and base domain in their SANs, and ACME authorization
requests both identifiers. The cert filenames are kept still based
on the base domain with the wildcard prefix stripped, so we aren't
creating separate files. DNS challenges still used the base domain

The checkCertDomain function is replaced by resolveCertDomain that
both validates and returns the appropriate cert domain to request.
Name validation is now moved earlier into GetCertPEMWithValidity()

Fixes #1196

Signed-off-by: Fernando Serboncini <fserb@tailscale.com>
7 days ago
..
auditlog syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging 2 months ago
conffile cmd/tailscale/cli,ipn/conffile: add declarative config mode for Services (#17435) 3 months ago
desktop go.mod: bump golang.org/x/crypto (#17907) 2 months ago
ipnauth ipn/ipnauth, safesocket: defer named pipe client's token retrieval until ipnserver needs it 3 weeks ago
ipnext ipn/ipnlocal: remove all the weird locking (LockedOnEntry, UnlockEarly, etc) 2 months ago
ipnlocal ipn/ipnlocal: add wildcard TLS certificate support for subdomains 7 days ago
ipnserver feature/featuretags, all: add build features, use existing ones in more places 3 months ago
ipnstate cmd/tailscale/cli: stabilise the output of `tailscale lock status --json` 1 month ago
lapitest various: allow tailscaled shutdown via LocalAPI 4 months ago
localapi client/local: add method to set gauge metric to a value 4 weeks ago
policy ipn,tailconfig: clean up unreleased and removed app connector service 2 years ago
store ipn/store, feature/condregister: permit callers to empty import optonal ipn stores 3 months ago
backend.go types/netmap: remove PrivateKey from NetworkMap 2 months ago
backend_test.go ipn: fix the string representation of an empty ipn.Notify 4 months ago
conf.go ipn: ensure that conffile is source of truth for advertised services. (#15361) 10 months ago
doc.go ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate 12 months ago
ipn_clone.go cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16 2 months ago
ipn_test.go all: do not depend on the testing package 2 years ago
ipn_view.go cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16 2 months ago
prefs.go cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16 2 months ago
prefs_test.go cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16 2 months ago
serve.go cmd/tailscale,ipn: add Unix socket support for serve 1 month ago
serve_expand_test.go cmd/tailscale,ipn: add Unix socket support for serve 1 month ago
serve_test.go ipn/serve: validate service paths in HasPathHandler 2 months ago
store.go cmd/tailscaled,ipn: show a health warning when state store fails to open (#17883) 2 months ago
store_test.go ipn/store: automatically migrate between plaintext and encrypted state (#16318) 7 months ago