Remove Snowflake broker configuration for "snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net"
Since #40349 (closed), connecting to the snowflake broker without SNI causes the server to send the certificate for snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net:
$ openssl s_client -noservername -connect snowflake-broker.torproject.net:443
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = E5
verify return:1
depth=0 CN = snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net
verify return:1
---
Certificate chain
0 s:CN = snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net
i:C = US, O = Let's Encrypt, CN = E5
a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
v:NotBefore: Dec 1 19:22:55 2024 GMT; NotAfter: Mar 1 19:22:54 2025 GMT
1 s:C = US, O = Let's Encrypt, CN = E5
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
This is unexpected.
It is possible that Nginx is defaulting to /etc/nginx/sites-enabled/https-site,
because that file, unlike https-site-broker-prod and https-site-broker-prod-freeheaven,
does not have a server_name
directive.
In any case, snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net was only used for testing.
Please remove its configuration.