Skip to content

TLS not enabling for dynamic fastly backends #42

@ChristianPavilonis

Description

@ChristianPavilonis

Problem:
The ensure_backend function in the Fastly adapter has several issues that can cause TLS connections to fail or behave unexpectedly:

  1. Missing default ports — When a URI has no explicit port, the backend target is set to just the hostname (e.g., example.com) instead of example.com:443 or example.com:80. This can cause connection issues.
  2. Incomplete SSL configuration — The original code only calls enable_ssl() but omits sni_hostname() and check_certificate(), which are required for proper TLS with SNI and certificate validation.
  3. No timeouts — The backend has no timeout configuration, relying on unknown Fastly defaults.
  4. Fragile error handling — On builder.finish() failure, the code retries with a second builder without override_host, which may work by accident but doesn't properly handle the "backend name already exists" case.
  5. Hash-based naming — Backend names like edgezero-dynamic-a1b2c3d4... are hard to debug in logs.
    Expected behavior:
    Dynamic backends should have explicit ports, proper TLS configuration with SNI/certificate validation, sensible timeouts, and clear error handling for the "name already in use" case.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions