Details
-
New Feature
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
Description
Description:
Add sni_mapping_file setting to listeners. The file contents define a mapping of hostname to a certificate and a MaxScale service. This allows MaxScale to serve multiple services through one listener port. The selected certificate and service depend on the hostname the client requests in the TLS negotiation.
Original description:
If the client sends the hostname in the TLS SNI, select the service based on that. As a fallback, if no TLS SNI is present but connection attributes define _server_host, use that.
The set of services that are reachable from the listener is defined in a new setting named virtual_services which takes a mapping of hostnames to services in MaxScale.
[Listener]
|
type=listener
|
port=3306
|
service=DefaultService
|
virtual_services=foo.db.com=FooService,bar.db.com=BarService
|
This way, if a client connects on port 3306 with a TLS connection that sets the SNI value to foo.db.com, the FooService is used. If the client connects to an unknown hostname, the normal behavior of using the service from the service setting is used.
Attachments
Issue Links
- is blocked by
-
MXS-5976 Select TLS certificate based on the SNI value
-
- Closed
-
- is part of
-
MXS-5976 Select TLS certificate based on the SNI value
-
- Closed
-
- relates to
-
CONJ-1282 SNI TLS support
-
- Closed
-
-
MDEV-10658 Support TLS SNI in MariaDB
-
- Open
-