v0.34.4

src/tls/server_config.rs

@@ -372,10 +372,15 @@ pub fn compile(settings: &Settings, directory: Option<&Path>) -> Result<Option<A
                 .strip_prefix("*.")
                 .map(|base| format!("rustproxy-wildcard-check.{base}"))
                 .unwrap_or_else(|| host.clone());
-            let mut checker = ResolvesServerCertUsingSni::new();
-            checker
-                .add(&validation_name, key.clone())
-                .with_context(|| format!("certificate does not cover {host}"))?;
+            if !settings.forced_mismatches.contains(&(cert.id.clone(), host.clone())) {
+                let mut checker = ResolvesServerCertUsingSni::new();
+                checker
+                    .add(&validation_name, key.clone())
+                    .with_context(|| format!("certificate does not cover {host}; explicit Vhost consent is required to override"))?;
+            } else {
+                tracing::warn!(certificate = %cert.id, hostname = %host,
+                    "Explicitly serving a TLS certificate without hostname verification; clients may reject it");
+            }
             names.insert(host, Arc::new(key.clone()));
         }
         if settings.default_certificate.as_deref() == Some(cert.id.as_str()) {