# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1642489456 -3600
# Node ID b05e0b422ff726698a829ebbec2158404f8d7b1f
# Parent  c5788969b8124a333d799b950c9f4d685eac272d
core.certmanager: Apply TLS preset before global settings (thanks Menel)

Allows overriding settings via the global 'ssl' settings as before.
This order was probably accidental. That said, 'ssl' is a giant footgun
we will want to discourage use of.

diff -r c5788969b812 -r b05e0b422ff7 core/certmanager.lua
--- a/core/certmanager.lua	Mon Jan 17 14:18:27 2022 +0000
+++ b/core/certmanager.lua	Tue Jan 18 08:04:16 2022 +0100
@@ -350,11 +350,11 @@
 		-- We can't read the password interactively when daemonized
 		password = function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end;
 	});
-	cfg:apply(global_ssl_config);
 	local preset = configmanager.get("*", "tls_preset") or "intermediate";
 	if preset ~= "legacy" then
 		cfg:apply(mozilla_ssl_configs[preset]);
 	end
+	cfg:apply(global_ssl_config);
 
 	for i = select('#', ...), 1, -1 do
 		cfg:apply(select(i, ...));