Configurable TLS server clientCertificate request and validation behavior #94
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hellt
reviewed
Apr 11, 2023
hellt
reviewed
Apr 11, 2023
hellt
reviewed
Apr 11, 2023
hellt
reviewed
Apr 11, 2023
hellt
reviewed
Apr 11, 2023
hellt
approved these changes
Apr 11, 2023
Co-authored-by: Roman Dodin <dodin.roman@gmail.com>
Co-authored-by: Roman Dodin <dodin.roman@gmail.com>
Co-authored-by: Roman Dodin <dodin.roman@gmail.com>
Co-authored-by: Roman Dodin <dodin.roman@gmail.com>
Co-authored-by: Roman Dodin <dodin.roman@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a configuration attribute to control when and how a server requests and validates a client TLS certificate.
This applies to the api-server, the gnmi-server, the tunnel server and the prometheus output.
The new attribute name is
client-authand is set under the TLS config of each of the servers specified above.client-authhas 4 possible values:The server requests a certificate from the client but does not require the client to send a certificate.
If the server sends a certificate, it is not required to be valid.
The server requires the client to send a certificate and does not fail if the client certificate is not valid.
The server requests a certificate, does not fail if no certificate is sent. If a certificate is sent it is required to be valid.
The server requires the client to send a valid certificate.