envoyproxy/envoy

Add verify_client_certificate.

Open

#5,501 opened on Jan 6, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/tlshelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

From https://github.com/envoyproxy/envoy/pull/5207#issuecomment-447345279:

I think that we could simply add verify_client_certificate: true|check|false, where:

  • true would verify the client certificate and reject connection if the verification failed (what we have today),
  • check would verify the client certificate, but forward it and the verification status via x-forwarded-client-cert or another header (for easier matching), regardless of the verification status,
  • false would forward the client certificate to the backend via x-forwarded-client-cert without attempting to verify it (to avoid crypto operations, do access control at the backend, etc.).

Contributor guide

Research direction
Examine the current TLS client certificate verification code in Envoy, specifically in the SSL connection handling. Identify where verify client certificate is currently implemented (likely true/false) and plan how to add a 'check' mode that forwards verification status.
Tech stack
c
Domain
security
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++TLS
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30