Are there any plans to add support for Server Name Indication (SNI)?

[tagadvance]

As the title says, are there any plans to add support for Server Name Indication (SNI)? I'd love to see an interface similar to TLS Channel's SniSslContextFactory so that certificates can be generated on-the-fly, e.g. using Let's Encrypt.

[tagadvance]

RFC9312

[ptrd]

You mean a way to have the server choose a certificate based on the hostname in the server_name extension in the Client Hello?

Currently no plans in that direction.

[tagadvance]

Thank you for the prompt reply. That's sad news as the library is otherwise very promising. You've obviously put a tremendous effort behind it.

[ptrd]

Well, let's keep it open, you never know when I suddenly get the urge ;-). But at the moment I'm working on several other improvements or features that I'd like to complete first.

Concerning this feature: given that you mention you'd like to generate certs on the fly, I guess you'd like some kind of callback interface to let the user of the library decide what certificate to return for a given hostname?

[ptrd]

@tagadvance ?

[tagadvance]

Yes, that's correct. In my case I'm looking at building a small web accelerator where I intercept traffic and generate SSL certificates on-the-fly using a certificate authority. I have a proof-of-concept written but it only supports HTTP/1.1 at the moment. If I'm going to invest all this time I figured I'd be better off sticking to the latest and greatest, i.e. HTTP/3, and went looking for a library written in a language I'm familiar with. That's when I found Kwik and Flupke.