Hacker News Reader

What does this mean?

> Make it possible to configure server-side connections based on client input.

The other three bullet points I can immediately understand what they're achieving (the "No-panic policy" is trickiest but since I'm learning Rust I knew what that means, and it also links a ticket describing more)

But for this one I haven't a clue, maybe it should be obvious, and somebody else will explain.

View on HN

Using (defined) properties of the TLS ClientHello to determine how the server will respond.

For example, changing the certificate used based on the ALPN identity, the SNI server host, and the advertised client ciphersuites.

I've been doing this by implementing ResolvesServerCert, which has access to the ClientHello. It covers the acme alpn use case.

Though you can't use it to pick other properties, like making an ALPN protocol conditional on SNI.

Reply on news.ycombinator.com