Skip to content

httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325)#7507

Merged
francislavoie merged 1 commit intocaddyserver:masterfrom
pauloappbr:fix/7325-default-sni
Feb 22, 2026
Merged

httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325)#7507
francislavoie merged 1 commit intocaddyserver:masterfrom
pauloappbr:fix/7325-default-sni

Conversation

@pauloappbr
Copy link
Contributor

Assistance Disclosure

I consulted Gemini to help analyze the issue, locate the bug, and draft the fix and regression test. I have reviewed and verified that the code and logic are correct.


Fixes #7325.

What this PR does / why we need it:
In a previous PR (#5808), a nil pointer check was added for srv.AutoHTTPS to prevent a panic when evaluating srv.AutoHTTPS.Skip. However, because srv.AutoHTTPS is nil by default (when Auto HTTPS is fully enabled), this accidentally caused hasTLSEnabled to evaluate to false for site blocks without an explicit https:// scheme.

As a result, global TLS options like default_sni and fallback_sni were not propagated to tls_connection_policies during the adapter build phase, causing SNI-less clients to fail handshakes.

This PR fixes the logic by properly handling the nil state of srv.AutoHTTPS (i.e., treating nil as having no skip conditions):
srv.AutoHTTPS == nil || !slices.Contains(...)

I've also added a regression test to ensure default_sni is always properly attached to the generated JSON configuration, even without an explicit https:// block.

@francislavoie francislavoie added the bug 🐞 Something isn't working label Feb 21, 2026
@francislavoie francislavoie added this to the v2.11.2 milestone Feb 21, 2026
@francislavoie francislavoie merged commit 7ffb640 into caddyserver:master Feb 22, 2026
29 checks passed
@github-actions github-actions bot mentioned this pull request Mar 6, 2026
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug 🐞 Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cannot get default_sni to work

2 participants