From e16e829181f2f843c08649312ae7257bbc7c3713 Mon Sep 17 00:00:00 2001
From: Yong Tang <yong.tang.github@outlook.com>
Date: Mon, 13 Jul 2026 17:34:18 -0700
Subject: [PATCH] plugin/forward: Fix issue in DoH health checks used a default
 TLS instead of the configured CA (#8279)

This PR fixes issue in forward plugin where default TLS instead of
configured CA was used.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
---
 plugin/forward/setup.go      |  1 +
 plugin/forward/setup_test.go | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/plugin/forward/setup.go b/plugin/forward/setup.go
index b661b300e..efba8c7bb 100644
--- a/plugin/forward/setup.go
+++ b/plugin/forward/setup.go
@@ -244,6 +244,7 @@ func parseStanza(c *caddy.Controller) (*Forward, error) {
 				Timeout:   2 * time.Second,
 			}
 			f.proxies[i].SetHTTPClient(&c)
+			f.proxies[i].SetTLSConfig(f.tlsConfig)
 			f.proxies[i].SetDOHRequestOptions(f.dohMethod)
 		}
 
diff --git a/plugin/forward/setup_test.go b/plugin/forward/setup_test.go
index b0b9d0f87..c31357d68 100644
--- a/plugin/forward/setup_test.go
+++ b/plugin/forward/setup_test.go
@@ -906,3 +906,30 @@ func TestSetupReadTimeout(t *testing.T) {
 		})
 	}
 }
+
+func TestSetupDOHHealthcheckTLSConfig(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		`forward . https://127.0.0.1 {
+			tls_servername dns.example
+		}`,
+	)
+
+	fs, err := parseForward(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := fs[0].
+		proxies[0].
+		GetHealthchecker().
+		GetTLSConfig()
+
+	if got.ServerName != "dns.example" {
+		t.Fatalf(
+			"Expected DoH healthcheck TLS server name %q, got %q",
+			"dns.example",
+			got.ServerName,
+		)
+	}
+}