-
Notifications
You must be signed in to change notification settings - Fork 6.3k
Description
Problem
Currently the Netdata Child agent in streaming mode is not sending the SNI, besides being defined in the stream.conf
Description
I would like that Netdata Child be able to send the HostSNI to be able to complete the TLS handshake, specially on scenarios where the certificate was issued for an specific domain.
Importance
nice to have
Value proposition
- It allow configurations in local setups were al traffic is routed trough a DNS to a single port using a hostname.
- Whit this feature we can avoid hours of troubleshooting, even AIs cannot figure it out
Proposed implementation
The child client must send the HostSNI to the parent if available in the conf file, not the raw resolved IP or simply add in the docs that the SNI is not being sent from the child to avoid long troubleshooting periods, or if is already posible trough configuration make it easier to find.
To test this you required a minimal setup of a reverse proxy that supports TCP multiplexing and TLS, assign the shared port for the services you are hosting, add a rule to route connections to the parent netadata service ensuring that maches only tcp connections with SNI headers. The child must be set to sent an SSL connection using <host>:<port>:SSL and the parent should be serving the certificate issued for that particular Host. It doesn't matter if the parent verifies or not the certificate, it would fail anyways.