You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/cmd
Andrew Dunham 2755f3843c health, net/tlsdial: add healthcheck for self-signed cert
When we make a connection to a server, we previously would verify with
the system roots, and then fall back to verifying with our baked-in
Let's Encrypt root if the system root cert verification failed.

We now explicitly check for, and log a health error on, self-signed
certificates. Additionally, we now always verify against our baked-in
Let's Encrypt root certificate and log an error if that isn't
successful. We don't consider this a health failure, since if we ever
change our server certificate issuer in the future older non-updated
versions of Tailscale will no longer be healthy despite being able to
connect.

Updates #3198

Change-Id: I00be5ceb8afee544ee795e3c7a2815476abc4abf
Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2 years ago
..
addlicense all: update tools that manage copyright headers 2 years ago
cloner all: update tools that manage copyright headers 2 years ago
containerboot all: update copyright and license headers 2 years ago
derper health, net/tlsdial: add healthcheck for self-signed cert 2 years ago
derpprobe cmd/derpprobe: migrate to the prober framework 2 years ago
gitops-pusher all: update copyright and license headers 2 years ago
hello all: update copyright and license headers 2 years ago
k8s-operator cmd/k8s-operator: use unstable tailscale image as well 2 years ago
mkmanifest all: update copyright and license headers 2 years ago
mkpkg all: update copyright and license headers 2 years ago
nardump all: update copyright and license headers 2 years ago
netlogfmt all: update copyright and license headers 2 years ago
nginx-auth all: update copyright and license headers 2 years ago
pgproxy all: update copyright and license headers 2 years ago
printdep all: update copyright and license headers 2 years ago
proxy-to-grafana all: update copyright and license headers 2 years ago
speedtest all: update copyright and license headers 2 years ago
ssh-auth-none-demo all: update copyright and license headers 2 years ago
stunc all: update copyright and license headers 2 years ago
sync-containers all: update copyright and license headers 2 years ago
tailscale health, net/tlsdial: add healthcheck for self-signed cert 2 years ago
tailscaled all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our fork 2 years ago
testcontrol all: update copyright and license headers 2 years ago
testwrapper all: update copyright and license headers 2 years ago
tsconnect cmd/tsconnect: update to xterm.js 5.1 2 years ago
tsshd all: update copyright and license headers 2 years ago
viewer all: update tools that manage copyright headers 2 years ago