wweir b2b344e948 feat(sowerd): answer TLS handshake for non-whitelisted SNI ...

A handshake failure on unknown SNI is an active-probing signal: real
sites present their default vhost certificate. Whitelisted names keep
the plain autocert path with errors surfaced as-is; unknown or empty
SNI falls back to the primary domain's certificate, carrying the
client hello over so autocert derives the same ECDSA/RSA cache key.

The h2-on-fallback companion idea was investigated and rejected:
httputil.ReverseProxy has no RFC 8441 support and x/net gates
extended CONNECT behind GODEBUG only, which would break WingGate WSS.

2026-09-18 17:38:17 +08:00

..

sower

fix(sower,admin): keep CONNECT tunnel head, bound SOCKS5 handshake, harden admin config and login

2026-08-12 17:15:54 +08:00

sowerd

feat(sowerd): answer TLS handshake for non-whitelisted SNI

2026-09-18 17:38:17 +08:00