[tls] Backport - Remove use of SSL_CTX_set_client_CA_list for TLS server credentials. #33583
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ials. (grpc#33558) This PR does the following: for the TLS server credentials, stops calling `SSL_CTX_set_client_CA_list` by default in `ssl_transport_security.cc`, and gives users a knob to re-enable calling this API. When this API is called, a gRPC TLS server sends the following data in the ServerHello: for each certificate in the server's trust bundle, the CA name in the certificate. This API does not change the set of certificates trusted by the server in any way. Rather, it is just providing a hint to the client about what client certificate should be sent to the server. default for the TLS server credentials? Removing the use of this API by default has 2 benefits: 1. Calling this API makes gRPC TLS unusable for servers with a sufficiently large trust bundle. Indeed, if the server trust bundle is too large, then the server will always fail to build the ServerHello. 2. Calling this API is introducing a huge amount of overhead (1000s of bytes) to each ServerHello, so removing this feature will improve connection establishment latency for all users of the TLS server credentials.
matthewstevenson88
added
area/security
release notes: yes
grpc-checks
bot
added
per-call-memory/neutral
per-channel-memory/neutral
bloat/none
labels
yijiem
approved these changes
Jul 5, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #33558.