1
0
This commit is contained in:
Neil Johnson
2019-03-01 10:33:38 +00:00
parent d8e2077c3c
commit a9c14a2b66
3 changed files with 15 additions and 15 deletions
+1 -1
View File
@@ -378,7 +378,7 @@ To configure Synapse to expose an HTTPS port, you will need to edit
for having Synapse automatically provision and renew federation
certificates through ACME can be found at [ACME.md](docs/ACME.md). If,
alternatively, you wish to delegate a TLS certificate from another domain
see the .well-known guide at [well-known.md](docs/well-known.md)
see the .well-known guide at [well-known.md](docs/well-known.md).
+5 -5
View File
@@ -138,7 +138,7 @@ automatically, please see `<docs/ACME.md>`_.
=================
For details on how to configure your TLS certificate such that one domain may
delegate to another please see `<docs/well-known>`_.
delegate to another please see `<docs/well-known.md>`_.
Security Note
=============
@@ -249,12 +249,12 @@ should have the format ``_matrix._tcp.<yourdomain.com> <ttl> IN SRV 10 0 <port>
Note that the server hostname cannot be an alias (CNAME record): it has to point
directly to the server hosting the synapse instance.
If it is not possible to acquire a certificate valid for you matrix domain,
the correct method is create a .well-known entry. For more details on how to
configure .well-known `see <https://github.com/matrix-org/synapse/blob/master/docs/well_known.md`_
If it is not possible to acquire a certificate valid for your matrix domain,
the correct method is create a .well-known file. For more details on how to
configure .well-known `see <docs/well_known.md>`_.
For those of you upgrading your TLS certificate in readiness for Synapse 1.0,
please take a look at `our guide <https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md#configuring-certificates-for-compatibility-with-synapse-100>`_
please take a look at `our guide <docs/MSC1711_certificates_FAQ.md#configuring-certificates-for-compatibility-with-synapse-100>`_.
Having created a valid TLS certificate you can then configure your homeserver
to use ``<yourdomain.com>`` as the domain in its user-ids, by setting
+9 -9
View File
@@ -16,7 +16,7 @@ with a `.well-known` lookup.
## Configuring `.well-known`
1. Give synapse a certificate corresponding to the target domain
(`customer.example.net`). Currently Synapse's ACME
(`customer.example.com`). Currently Synapse's ACME
support [does not support
this](https://github.com/matrix-org/synapse/issues/4552), so you will have
to acquire a certificate yourself and give it to Synapse via
@@ -34,16 +34,16 @@ with a `.well-known` lookup.
where the target server name is resolved as usual (i.e. SRV lookup, falling
back to talking to port 8448).
In the above example, where synapse is listening on port 8000,
`https://example.com/.well-known/matrix/server` should have `m.server`
set to one of:
In the above `example.com` exmaple above, where synapse is listening on
port 8000, `https://example.com/.well-known/matrix/server` should have
`m.server` set to one of:
1. `customer.example.net` ─ with a SRV record on
1. `customer.example.com` ─ with a SRV record on
`_matrix._tcp.customer.example.com` pointing to port 8000, or:
2. `customer.example.net` ─ updating synapse to listen on the default port
2. `customer.example.com` ─ updating synapse to listen on the default port
8448, or:
3. `customer.example.net:8000` ─ ensuring that if there is a reverse proxy
on `customer.example.net:8000` it correctly handles HTTP requests with
Host header set to `customer.example.net:8000`.
3. `customer.example.com:8000` ─ ensuring that if there is a reverse proxy
on `customer.example.com:8000` it correctly handles HTTP requests with
Host header set to `customer.example.com:8000`.