os-caddy: mTLS client auth for subdomains

[elcodeo]

Regarding the new feature mTLS client auth it would be great to have this setting for subdomains (if possible) also. Currently you can configure it for domains only.

[OPNsense-bot]

Thank you for creating an issue.
Since the ticket doesn't seem to be using one of our templates, we're marking this issue as low priority until further notice.

For more information about the policies for this repository,
please read https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md for further details.

The easiest option to gain traction is to close this ticket and open a new one using one of our templates.

[Monviech]

Hello,

this will not happen as the mTLS directive configures a domain.

Though starting with caddy binary version 2.10.0 the subdomain structure will become kinda deprecated due to this feature:

caddyserver/caddy#6959

As long as a wildcard domain is configured, you will be able to configure all its subdomains as normal domains and the wildcard cert will be automatically shared. This means you can also configure the mTLS for each of them.

[elcodeo]

Hello, thank you for the response. I tried your solution regarding „wildcard domains“ and it worked. What I found out meanwhile is that only one certificate works. If I select multiple certificates none of them will be successfully verified.

[Monviech]

It says here multiples are allowed which is what I implemented:

https://caddyserver.com/docs/caddyfile/directives/tls#trust_pool

Maybe try the caddy forum and share your caddyfile and the issue you are facing. If its a Caddyfile issue just ping me again with the solution.

[Monviech]

Will be added to subdomains options in frontend when this has been changed:

#4672

[elcodeo]

Great! Thank you for the information.