envoyproxy/envoy

Dynamic Per-Connection Certificates for QUIC in Envoy

Open

#42063 opened on Nov 17, 2025

View on GitHub
 (1 comment) (0 reactions) (0 assignees)C++ (27,997 stars) (5,373 forks)batch import
enhancementhelp wanted

Description

Hi all,

I’m exploring a setup where Envoy should present different TLS certificates on a per-QUIC-connection basis, depending on the SNI. Because some clients use ECH, the inner SNI may be encrypted, id like to instead infer the intended SNI from dynamic metadata we set at the listener filter.

A couple of questions:

Is there a recommended approach for selecting certificates dynamically for QUIC based on per-connection metadata (rather than the SNI visible to Envoy)?

Is there any experimental support or planned API to give the QUIC handshake access to FilterState, dynamic metadata, or similar Conn-level information during certificate selection?

Any guidance, design pointers, or examples would be greatly appreciated. Thanks!

Contributor guide

Tech stack
cpp
Domain
backendinfrastructuresecurityperformance
Issue type
research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
5
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
needs investigation
Prerequisites
Understanding of Envoy proxy internalsKnowledge of TLS/QUIC handshake
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
10
Research direction
Investigate how Envoy's QUIC handshake can access per connection metadata like FilterState or dynamic metadata for certificate selection. Explore the existing certificate selection mechanisms (e.g., SdsConfig, static certs) and assess feasibility of extending them. Examine source code in source/common/quic/ for hooks during handshake. Consider documented limitations and engage with maintainers on design alternatives.