Compare commits
4 Commits
4fe312929b
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
| 9bf4ffad38 | |||
| e6befea75e | |||
| 3a781a129a | |||
| 2769994edd |
BIN
assets/powered_by_netbsd.png
Normal file
BIN
assets/powered_by_netbsd.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4.9 KiB |
176
index.html
176
index.html
@@ -1,87 +1,95 @@
|
|||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
<html lang="en">
|
<html lang="en">
|
||||||
<head>
|
<head>
|
||||||
<title>rawley.xyz</title>
|
<title>rawley.xyz</title>
|
||||||
<meta charset="UTF-8">
|
<meta charset="UTF-8">
|
||||||
<meta name="description" value="Rawley Fowler's personal website, about Perl, Emacs and Software in General.">
|
<meta name="description" value="Rawley Fowler's personal website, about Perl, Emacs and Software in General.">
|
||||||
<link rel="stylesheet" href="index.css">
|
<meta name="keywords" value="Rawley Fowler rawley.xyz emacs netbsd functional clojure perl software architecture bugs fixing maker">
|
||||||
</head>
|
<link rel="stylesheet" href="index.css">
|
||||||
<body>
|
</head>
|
||||||
<div>
|
<body>
|
||||||
<p>
|
<div class="blerb">
|
||||||
Hi, I'm Rawley. I'm a full-time Husband, Dad, Emacs evangelist and Perl aficionado.
|
<p>
|
||||||
</p>
|
Hi, I'm Rawley. I'm a full-time Husband, Dad, Emacs evangelist and Perl aficionado.
|
||||||
<p>
|
</p>
|
||||||
I am the creator of many <a href="https://www.gnu.org/philosophy/free-sw.en.html">free-software</a> libraries and tools.
|
<p>
|
||||||
I have extensive knowledge of Perl, Java, JVM, and Functional Programming. I'm always working on something, whether it be my
|
I am the creator of many <a href="https://www.gnu.org/philosophy/free-sw.en.html">free-software</a> libraries and tools.
|
||||||
100 year old house, or some 100 year old code.
|
I have extensive knowledge of Perl, Java, JVM, and Functional Programming. I'm always working on something, whether it be my
|
||||||
</p>
|
100 year old house, or some 100 year old code.
|
||||||
<p>
|
</p>
|
||||||
I'm always looking for interesting things to work on.
|
<p>
|
||||||
If you have a project you think might suite me, send me an email at <strong>rawley</strong> at <strong>molluscsoftware.com</strong>
|
I'm always looking for interesting things to work on.
|
||||||
</p>
|
If you have a project you think might suite me, send me an email at <strong>rawley</strong> at <strong>molluscsoftware.com</strong>
|
||||||
<h2>Blog Posts</h2>
|
</p>
|
||||||
<ul>
|
<h2>Blog Posts</h2>
|
||||||
<li>
|
<ul>
|
||||||
<a href="/posts/html-composer.html">Perl HTML Templating and HTML::Composer</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/html-composer.html">Perl HTML Templating and HTML::Composer</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/perl-in-2025.html">Perl in 2025</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/perl-in-2025.html">Perl in 2025</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/niche-software.html">Using a niche programming language</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/niche-software.html">Using a niche programming language</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/dancer2-controllers.html">Dancer2::Controllers and Perl Attributes</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/dancer2-controllers.html">Dancer2::Controllers and Perl Attributes</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/perl-oo-action-benchmark.html">Perl OO benchmarks</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/perl-oo-action-benchmark.html">Perl OO benchmarks</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/maybe-escaping-evil.html">Exploring <code>evil-mode</code> alternatives</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/maybe-escaping-evil.html">Exploring <code>evil-mode</code> alternatives</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/in-defense-of-global-variables.html">How to Properly use Global Variables</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/in-defense-of-global-variables.html">How to Properly use Global Variables</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/2024.html">2024</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/2024.html">2024</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/jpa-hibernate-stupid-performance.html">Making JPA Repository stupid fast with Entity Graph</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/jpa-hibernate-stupid-performance.html">Making JPA Repository stupid fast with Entity Graph</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/docker-mod-perl.html">Running Mojolicious with <code>mod_perl</code> in Docker</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/docker-mod-perl.html">Running Mojolicious with <code>mod_perl</code> in Docker</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/emacs.html">Emacs</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/emacs.html">Emacs</a>
|
||||||
<li>
|
</li>
|
||||||
<a href="/posts/become-an-engineer.html">The real software path</a>
|
<li>
|
||||||
</li>
|
<a href="/posts/become-an-engineer.html">The real software path</a>
|
||||||
</ul>
|
</li>
|
||||||
<h2>Noteworthy Projects</h2>
|
</ul>
|
||||||
<ul>
|
<h2>Noteworthy Projects</h2>
|
||||||
<li>
|
<div class="projects">
|
||||||
<a href="https://github.com/mollusc-labs/slapbird">SlapbirdAPM</a>
|
<ul>
|
||||||
</li>
|
<li>
|
||||||
<li>
|
<a href="https://github.com/mollusc-labs/slapbird">SlapbirdAPM</a>
|
||||||
<a href="https://github.com/rawleyfowler/Humming-Bird">Humming-Bird</a>
|
</li>
|
||||||
</li>
|
<li>
|
||||||
<li>
|
<a href="https://github.com/rawleyfowler/Humming-Bird">Humming-Bird</a>
|
||||||
<a href="https://github.com/rawleyfowler/mojolicious-Plugin-IsBot">Mojolicious::Plugin::IsBot</a>
|
</li>
|
||||||
</li>
|
<li>
|
||||||
</ul>
|
<a href="https://github.com/rawleyfowler/mojolicious-Plugin-IsBot">Mojolicious::Plugin::IsBot</a>
|
||||||
<br />
|
</li>
|
||||||
<div>
|
</ul>
|
||||||
<a href="http://www.gnu.org/software/emacs">
|
</div>
|
||||||
<img src="/assets/gnu_emacs.png"/>
|
<div class="cards">
|
||||||
</a>
|
<a href="http://www.gnu.org/software/emacs">
|
||||||
<a href="https://openbsd.org">
|
<img src="/assets/gnu_emacs.png" width="88" height="31"/>
|
||||||
<img src="/assets/openbsd.gif" style="width: 120px; height 80px" />
|
</a>
|
||||||
</a>
|
<a href="http://www.gnu.org/software/emacs">
|
||||||
</div>
|
<img src="/assets/made_with_emacs.png" width="88" height="31"/>
|
||||||
<h2>Disclaimer</h2>
|
</a>
|
||||||
<p>All opinions are my own, they do not reflect the thoughts expressed by my employer(s) past, present, or future.</p>
|
<a href="https://netbsd.org">
|
||||||
</div>
|
<img src="/assets/powered_by_netbsd.png" width="88" height="31"/>
|
||||||
</body>
|
</a>
|
||||||
|
<a href="#">
|
||||||
|
<img src="/assets/no_bad_hair_days.png" width="88" height="31"/>
|
||||||
|
</a>
|
||||||
|
</div>
|
||||||
|
<h2>Disclaimer</h2>
|
||||||
|
<p>All opinions are my own, they do not reflect the thoughts expressed by my employer(s) past, present, or future.</p>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
32
posts/fix-apache-sni-behind-alb.html
Normal file
32
posts/fix-apache-sni-behind-alb.html
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Fix Apache 421 SNI Errors Behind AWS ALB</title>
|
||||||
|
<meta content="Description of post" name="description">
|
||||||
|
<meta name="robots">
|
||||||
|
<meta content="keywords" name="Apache SNI Fix 421">
|
||||||
|
<meta content="description" name="How to fix the Apache SNI issues (421 misdirected) behind AWS ALB">
|
||||||
|
<meta charset="utf-8" content="utf-8" name="charset">
|
||||||
|
<link href="/index.css" rel="stylesheet">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<a href="/"><< back</a>
|
||||||
|
<h1>Fixing Apache SNI 421 Errors Behind AWS ALB</h1>
|
||||||
|
<h2>Understanding the Problem</h2>
|
||||||
|
<p>
|
||||||
|
SNI (Server Name Indicator) is a flag set in the "Client Hello" of a TLS request. It tells the server what domain you want,
|
||||||
|
without having to decrypt the request later to get the <code>Host</code> header, or whatever else you might be using to route traffic with.
|
||||||
|
Apache uses SNI to figure out what cert to use to decrypt the request. When SNI is missing, or Apache can't find a VHost associated
|
||||||
|
with the domain in the SNI, it will route to the default VHost for decryption and request handling. This is now the default behaviour in 2.4.64 and up,
|
||||||
|
it was applied to fix CVE-2025-23048. Note this is a good change, and means that Apache will reject potentially dangerous requests where SNI isn't the same as the Host header.
|
||||||
|
</p>
|
||||||
|
<h2>Solution</h2>
|
||||||
|
<p>
|
||||||
|
If you're using HTTPS on your Apache, behind an AWS ALB, you're going to run into this issue, because AWS ALB's seemingly don't set SNI at all.
|
||||||
|
The solution is to tell Apache to relax its policy, and allow the default VHost to decrypt the message,
|
||||||
|
and then route on the Host header to the next VHost (I think this is how it works, I could be wrong).
|
||||||
|
You can do this with the <code>SSLVHostSNIPolicy</code> directive, setting it to <code>authonly</code> will
|
||||||
|
return the pre 2.4.64 functionality, however it supposedly only works on 2.4.65, so you may have to skip 2.4.64.
|
||||||
|
</p>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
Reference in New Issue
Block a user