Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv...
by stephenr on Tuesday September 19, 2017 @01:18PM
(#15286595)
My issue is with caddy.
FYI, the issue a few months back wasn't "software breaks".
It worked exactly as they designed and implemented it.
The original issue was closed, before (as seems to be a pattern lately) they changed direction when they received so much negative feedback about their highly opinionated choices for the project.
To this day the same logic is still in caddy, but with a longer grace period. Try starting caddy offline with a cert that expires in less than 7 days.
I don't trust someone to develop a server if they think failing to start at all, is better than starting with close to expired or even expired certificates.
FYI, the issue a few months back wasn't "software breaks".
It worked exactly as they designed and implemented it. The original issue was closed, before (as seems to be a pattern lately) they changed direction when they received so much negative feedback about their highly opinionated choices for the project.
To this day the same logic is still in caddy, but with a longer grace period. Try starting caddy offline with a cert that expires in less than 7 days.
I don't trust someone to develop a server if they think failing to start at all, is better than starting with close to expired or even expired certificates.