Comments (2)
relayd ssl inspection: lost child: pid 60617 terminated; signal 10
https://marc.info/?l=openbsd-bugs&m=151124171221288&w=2
from vedetta.
For -current
file etc/pf.conf, in anchor "internal", child anchor "in"
# relayd HTTP layer7 TLS inspection (split IPv4/6)
anchor proto tcp from <tlsinspect> to port https tagged LAN_INET {
pass log inet \
divert-to lo0 port 8443 \
tag LAN_SELF
pass log inet6 \
divert-to lo0 port 8443 \
tag LAN6_SELF6
}
file etc/relayd.conf
http protocol httpsfilter {
return error
match header set "Connection" value "close"
pass
# pass quick url file "/etc/relayd.d/custom_whitelist"
# block url file "/etc/relayd.d/custom_blacklist"
# include "/etc/relayd.d/auto_blacklist"
tls ca key "/etc/ssl/relayd/private/ca.key" password "password123"
tls ca cert "/etc/ssl/relayd/ca.crt"
}
relay tlsinspect {
# Listen on localhost, accept diverted connections from pf(4)
listen on 127.0.0.1 port 8443 tls
listen on ::1 port 8443 tls
protocol httpsfilter
# Forward to the original target host
forward with tls to destination
}
Create your own Certificate Authority (CA), called relayd
To start, first generate a new local CA key and certificate:
# mkdir -p /etc/ssl/relayd/private
# openssl req -x509 -days 365 -newkey rsa:2048 \
-keyout /etc/ssl/relayd/private/ca.key -out /etc/ssl/relayd/ca.crt
Create Certificate Signing Requests (CSRs) for relayd TLS server
You will also need an SSL server key and cert for 127.0.0.1, see "listen on" in the RELAYS section of relayd.conf(5) and ssl(8) for more details.
Note that some new browsers have deprecated using the common name of a certificate and require that subject alt names are provided. This may require the use of -extfile server.ext when self-signing.
# echo 'subjectAltName=DNS:relay.vedetta.lan' > /etc/ssl/relayd/server.ext
Generate a private (unencrypted) key for relayd TLS server:
# openssl genrsa -out /etc/ssl/relayd/private/relay.vedetta.lan.key 2048
Generate a Certificate Signing Request (CSR) for relayd TLS server:
# openssl req -new -key /etc/ssl/relayd/private/relay.vedetta.lan.key \
-out /etc/ssl/relayd/private/relay.vedetta.lan.csr \
-nodes
Sign the relayd TLS server certificate with relayd CA:
# openssl x509 -sha256 -req -days 365 \
-in /etc/ssl/relayd/private/relay.vedetta.lan.csr \
-CA /etc/ssl/relayd/ca.crt -CAkey /etc/ssl/relayd/private/ca.key \
-CAcreateserial -extfile /etc/ssl/relayd/server.ext \
-out /etc/ssl/relayd/relay.vedetta.lan.crt
You can also sign the key yourself:
# openssl x509 -sha256 -req -days 365 \
-in /etc/ssl/relayd/private/relay.vedetta.lan.csr \
-signkey /etc/ssl/relayd/private/relay.vedetta.lan.key \
-out /etc/ssl/relayd/relay.vedetta.lan.crt
Create the links for "listen on" relay configuration directive:
# cd /etc/ssl
# ln -s relayd/relay.vedetta.lan.crt 127.0.0.1.crt
# ln -s relayd/relay.vedetta.lan.crt ::1.crt
# cd /etc/ssl/private
# ln -s ../relayd/private/relay.vedetta.lan.key 127.0.0.1.key
# ln -s ../relayd/private/relay.vedetta.lan.key ::1.key
from vedetta.
Related Issues (9)
- switchctl from hostname.switch0 fails HOT 2
- httpd: OCSP stapling is not used HOT 1
- Disable ciphers with DHE as Key Exchange
- relayd supports SNI and OCSP in OpenBSD 6.6
- rebound has been replaced by unwind
- scripts referenced in root crontab
- Add tftpd and tftp-proxy for autoinstall
- Transparent HTTP proxy (with filters) using relayd
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vedetta.