v2.4.8: only do fronting checks on TLS sockets

index.js

@@ -557,7 +557,8 @@ Greenlock.create = function (gl) {
         req.headers.host = host.join(':');
       }
 
-      if (!gl.__sni_allow_domain_fronting) {
+      // Note: This sanitize function is also called on plain sockets, which don't need Domain Fronting checks
+      if (req.socket.encrypted && !gl.__sni_allow_domain_fronting) {
         if (req.socket && 'string' === typeof req.socket.servername) {
           // Workaround for https://github.com/nodejs/node/issues/22389
           if (!gl._checkServername(safehost, req.socket.servername.toLowerCase())) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "greenlock",
-  "version": "2.4.7",
+  "version": "2.4.8",
   "description": "Let's Encrypt for node.js on npm",
   "main": "index.js",
   "files": [