tls_expiry: enable sni by default and use host for that?

[cpina]

the tls_expiry monitor: SNI seems quite common nowadays. Instead of having:

[lets-encrypt-certificat-pina-cat-28days]
type=tls_expiry
host=pina.cat
min_days=28
sni=pina.cat

Could be:

[lets-encrypt-certificat-pina-cat-28days]
type=tls_expiry
host=pina.cat
min_days=28

I think that SNI is used by default everywhere (or is part of the handshake when the browser connects there?).

I know that is hard to change default options without breaking existing monitors...

[jamesoff]

Yeah I’m always wary of changing defaults but I wonder if this one is probably safe. A new option can be added to disable SNI for cases where it’s not desirable, and presumably in those cases it will start failing if the remote end rejects the connection with it which will make it noisy immediately on upgrade.

[steven-geo]

I would leave as is, as you can use this to check a default certificate (ie localhost.localdomain), cert if you want, and these aren't always named the same. This change seems to just shift the problem, rather than improving the functionality.
The extra line in the config is kind of annoying, but it keeps clarity on what is happening, backwards compatibility is also a thing.

[cpina]

I would leave as is, as you can use this to check a default certificate (ie localhost.localdomain), cert if you want, and these aren't always named the same. This change seems to just shift the problem, rather than improving the functionality. The extra line in the config is kind of annoying, but it keeps clarity on what is happening, backwards compatibility is also a thing.

a new setting auto_sni = true or sni_is_host = true I think that would deal with the backward compatibility issues, and it would avoid the duplicate string in host and sni.

On the other hand, there might be bigger things to fix :-)

[steven-geo]

@cpina Definitely an option. I only monitor a handful of certs, but it's in the backlog. It would make the config a bit simpler.