wweir b2b344e948 feat(sowerd): answer TLS handshake for non-whitelisted SNI ...

A handshake failure on unknown SNI is an active-probing signal: real
sites present their default vhost certificate. Whitelisted names keep
the plain autocert path with errors surfaced as-is; unknown or empty
SNI falls back to the primary domain's certificate, carrying the
client hello over so autocert derives the same ECDSA/RSA cache key.

The h2-on-fallback companion idea was investigated and rejected:
httputil.ReverseProxy has no RFC 8441 support and x/net gates
extended CONNECT behind GODEBUG only, which would break WingGate WSS.

2026-09-18 17:38:17 +08:00

..

main_test.go

feat(sowerd): answer TLS handshake for non-whitelisted SNI

2026-09-18 17:38:17 +08:00

main.go

feat(sowerd): answer TLS handshake for non-whitelisted SNI

2026-09-18 17:38:17 +08:00

probe.go

feat(sowerd): reverse-proxy HTTP fake-site fallback with edge headers

2026-08-28 13:37:05 +08:00