add mTLS for gateway & proxy communication by wojcik91 · Pull Request #2726 · DefGuard/defguard

wojcik91 · 2026-04-16T08:26:45Z

Generate and store core client certificates during component setup.
Those certs are then sent to the gateway/proxy along with CA cert so they can validate client identity.

Related #2695

Needs DefGuard/proto#74

moubctez · 2026-04-16T11:37:52Z

        Ok(cert)
    }

+    /// Issue a Core gRPC client certificate for a specific gateway or proxy.


Suggested change

/// Issue a Core gRPC client certificate for a specific gateway or proxy.

/// Issue a Core gRPC client certificate for a specific Gateway or Edge.

moubctez · 2026-04-16T11:38:08Z

    }
 }

+/// A Core gRPC client certificate issued for a specific gateway or proxy component.


Suggested change

/// A Core gRPC client certificate issued for a specific gateway or proxy component.

/// A Core gRPC client certificate issued for a specific Gateway or Edge component.

moubctez · 2026-04-16T11:38:46Z

-    {
-        sqlx::query(
+    pub async fn mark_all_disconnected<'e, E: PgExecutor<'e>>(executor: E) -> sqlx::Result<()> {
+        query(


Suggested change

query(

query!(

moubctez · 2026-04-16T11:40:16Z

    let created_modified_at = created_alias_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:40:34Z

    let updated_modified_at = updated_alias_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:40:38Z

    let created_modified_at = created_destination_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:40:43Z

    let updated_modified_at = updated_destination_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:40:48Z

    let created_modified_at = created_rule_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:40:53Z

    let updated_modified_at = updated_rule_row.modified_at;

-    tokio::time::sleep(std::time::Duration::from_millis(2)).await;
+    sleep(std::time::Duration::from_millis(2)).await;


Magic value

moubctez · 2026-04-16T11:41:05Z

        let mut results = Vec::new();
        // Give the handler a brief moment to enqueue the message.
-        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        sleep(Duration::from_millis(50)).await;


Magic value

moubctez · 2026-04-16T11:41:10Z

    async fn drain_clear_https_certs(&mut self) -> usize {
        let mut results = 0;
-        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        sleep(Duration::from_millis(50)).await;


Magic value

moubctez · 2026-04-16T11:41:15Z

        timeout(TEST_TIMEOUT, async {
            while self.events_tx().receiver_count() <= initial_event_receivers {
-                tokio::time::sleep(Duration::from_millis(20)).await;
+                sleep(Duration::from_millis(20)).await;


Magic value

moubctez · 2026-04-16T11:41:20Z

            }

-            tokio::time::sleep(Duration::from_millis(20)).await;
+            sleep(Duration::from_millis(20)).await;


Magic value

moubctez · 2026-04-16T11:42:01Z

 }

-/// Create a rustls client config that enforces the pinned component certificate serial.
+/// Build a tonic [`ServerTlsConfig`] for a gateway or proxy gRPC server that enforces


Suggested change

/// Build a tonic [`ServerTlsConfig`] for a gateway or proxy gRPC server that enforces

/// Build a tonic [`ServerTlsConfig`] for a Gateway or Edge gRPC server that enforces

moubctez · 2026-04-16T11:42:26Z

@@ -0,0 +1,58 @@
+//! Server-side mTLS utilities for gateway and proxy gRPC servers.


Suggested change

//! Server-side mTLS utilities for gateway and proxy gRPC servers.

//! Server-side mTLS utilities for Gateway and Edge gRPC servers.

moubctez · 2026-04-16T11:42:59Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:04Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:10Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:15Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:19Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:24Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:43:29Z


    // Delay, so send_and_forget() can process the message.
-    tokio::time::sleep(Duration::from_secs(2)).await;
+    sleep(Duration::from_secs(2)).await;


Magic value

moubctez · 2026-04-16T11:44:31Z


-    let shutdown_signal =
-        tokio::time::timeout(std::time::Duration::from_secs(1), shutdown_rx).await;
+    let shutdown_signal = timeout(Duration::from_secs(1), shutdown_rx).await;


Magic value

moubctez · 2026-04-16T11:44:40Z

    assert_eq!(wizard.active_wizard, ActiveWizard::None);

-    let shutdown = tokio::time::timeout(std::time::Duration::from_secs(1), shutdown_rx).await;
+    let shutdown = timeout(Duration::from_secs(1), shutdown_rx).await;


Magic value

moubctez · 2026-04-16T11:45:22Z


-    let shutdown_signal =
-        tokio::time::timeout(std::time::Duration::from_secs(1), shutdown_rx).await;
+    let shutdown_signal = timeout(std::time::Duration::from_secs(1), shutdown_rx).await;


Magic value and just use Duration trimming std::time.

j-chmielewski · 2026-04-17T08:15:33Z

+///
+/// ```rust,ignore
+/// ServiceBuilder::new()
+///     .layer(tonic::service::interceptor(certificate_serial_interceptor(Some(serial))))


Suggested change

/// .layer(tonic::service::interceptor(certificate_serial_interceptor(Some(serial))))

/// .layer(tonic::service::interceptor(certificate_serial_interceptor(serial)))

wojcik91 added 13 commits April 14, 2026 18:11

add migration for core client certificates

b6192bc

update existing structs for updated DB fields

9375e71

add helpers for signing server/client certs

482bdd0

update query data

8885635

generate and store core client certs during component setup

72a6569

add helper for generating grpc server TLS config

5dfbcc0

add core client identity to component connections

7e78ab4

update query data

2fc96dc

tokio::time cleanup

f6a2b96

update protos

aef3978

cleanup

564dc72

add shared interceptor to check client cert serial

9e1054e

change interceptor signature

cb7231f

wojcik91 self-assigned this Apr 16, 2026

handle proxy handler shutdown during reconnect backoff

c12c46c

This was referenced Apr 16, 2026

add core client cert validation DefGuard/proxy#273

Open

add core client cert validation DefGuard/gateway#309

Open

moubctez reviewed Apr 16, 2026

View reviewed changes

Comment thread migrations/20260414120000_[2.0.0]_core_grpc_cert.down.sql

moubctez reviewed Apr 16, 2026

View reviewed changes

Comment thread migrations/20260414120000_[2.0.0]_core_grpc_cert.up.sql

wojcik91 added 4 commits April 16, 2026 14:18

remove more paths

dfbf7a5

review cleanup

32101ef

add more timeout constants

cde7255

reorganize setup integration tests to fix code sharing

4f6c19b

j-chmielewski requested changes Apr 17, 2026

View reviewed changes

wojcik91 added 7 commits April 17, 2026 11:10

explicitly require client auth

164b1da

update signature

710b1bf

avoid leaking certs in logs

3c76f4f

adjust down migration

0641a89

used shared helper for setting up Edge connections

40eb0eb

limit setup token validity

5d24cb5

verify CSR hostname during setup

3863968

	/// Issue a Core gRPC client certificate for a specific gateway or proxy.
	/// Issue a Core gRPC client certificate for a specific Gateway or Edge.

	/// A Core gRPC client certificate issued for a specific gateway or proxy component.
	/// A Core gRPC client certificate issued for a specific Gateway or Edge component.

	/// Build a tonic [`ServerTlsConfig`] for a gateway or proxy gRPC server that enforces
	/// Build a tonic [`ServerTlsConfig`] for a Gateway or Edge gRPC server that enforces

		@@ -0,0 +1,58 @@
		//! Server-side mTLS utilities for gateway and proxy gRPC servers.

	/// .layer(tonic::service::interceptor(certificate_serial_interceptor(Some(serial))))
	/// .layer(tonic::service::interceptor(certificate_serial_interceptor(serial)))

Uh oh!

Conversation

wojcik91 commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wojcik91 commented Apr 16, 2026 •

edited

Loading