From efdf0563521866c7ca669dff2518b6907b190d5e Mon Sep 17 00:00:00 2001 From: mk Date: Tue, 28 Jul 2026 06:55:31 +0300 Subject: [PATCH] =?UTF-8?q?hardening(angie):=20default=5Fserver=20needs=20?= =?UTF-8?q?a=20cert=20on=20its=20443=20listener=20or=20'angie=20-t'=20fail?= =?UTF-8?q?s=20with=20'no=20ssl=5Fcertificate=20defined'=20=E2=80=94=20gen?= =?UTF-8?q?erate=20a=20one-time=20self-signed=20dummy=20(CN=3Dbootstrap-de?= =?UTF-8?q?fault,=2010y)=20in=20/etc/angie/ssl=20so=20unknown-SNI=20client?= =?UTF-8?q?s=20handshake=20then=20get=20444;=20mark=20listen=20443=20as=20?= =?UTF-8?q?ssl=20explicitly?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- modules/50-hardening.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/modules/50-hardening.sh b/modules/50-hardening.sh index 382103d..175f34e 100755 --- a/modules/50-hardening.sh +++ b/modules/50-hardening.sh @@ -322,14 +322,25 @@ EOF # ── default catch-all server: unmatched Host -> drop ── if [[ ! -f "$d/_on/00-default.conf" ]]; then + # The default_server also listens on 443 to catch unknown-SNI TLS clients. + # It needs SOME cert to complete the handshake before `return 444` drops them; + # angie won't start a 443 listener without ssl_certificate. Generate a self-signed + # dummy once (CN='bootstrap-default', 10y) so unknown-SNI clients get dropped + # after connecting while real vhosts are picked by SNI. + if [[ ! -f "$d/ssl/bootstrap-default.crt" ]]; then + sudo_ install -d -m 0755 "$d/ssl" + sudo_ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 -keyout "$d/ssl/bootstrap-default.key" -out "$d/ssl/bootstrap-default.crt" -subj "/CN=bootstrap-default/O=bootstrap" 2>/dev/null + fi sudo_ tee "$d/_on/00-default.conf" >/dev/null <<'EOF' # default_server: drop requests that match no enabled host (drive-by scanners, bare-IP) server { listen 80 default_server; listen [::]:80 default_server; - listen 443 default_server; - listen [::]:443 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; server_name _; + ssl_certificate /etc/angie/ssl/bootstrap-default.crt; + ssl_certificate_key /etc/angie/ssl/bootstrap-default.key; return 444; } EOF