tlsdial

Documentation

Overview

Package tlsdial originally existed to set up a tls.Config for x509 validation, using a memory-optimized path for iOS, but then we moved that to the tailscale/go tree instead, so now this package does very little. But for now we keep it as a unified point where we might want to add shared policy on outgoing TLS connections from the 3 places in the client that connect to Tailscale (logs, control, DERP).

Index

• func Config(host string, base *tls.Config) *tls.Config
• func SetConfigExpectedCert(c *tls.Config, certDNSName string)

Functions

func Config

func Config(host string, base *tls.Config) *tls.Config

Config returns a tls.Config for connecting to a server. If base is non-nil, it's cloned as the base config before being configured and returned.

func SetConfigExpectedCert

func SetConfigExpectedCert(c *tls.Config, certDNSName string)

SetConfigExpectedCert modifies c to expect and verify that the server returns a certificate for the provided certDNSName.

This is for user-configurable client-side domain fronting support, where we send one SNI value but validate a different cert.