Caddy serves wrong SSL cert

Question

The problem is described in this issue: https://github.com/mholt/caddy/issues/1303

I want to fix this information leakage (giving an attacker the opportunity to enumerate all the different hosts served on my webserver).

Does somebody know how to fix it or work around it?

Answer 1

You can simply specify a default response to any non existing domain.

:443 {
  root c:\websites\nowebsite\
  tls self_signed

 }

This will be served anytime you recieve a request for an otherwise non existant domain.

It is worth noting however that ALL lets encrypt certs are published online in Certificate Transparancy logs.