SSL handshake fails because of too many certificate authorities
#14 208 ouverte le 30 nov. 2020
Métriques du dépôt
- Stars
- (27 997 étoiles)
- Métriques de merge PR
- (Merge moyen 8j) (378 PRs mergées en 30 j)
Description
Title: Initial ssl handshake fails because the ca cert file contains too many certificates (e.g more than 500 certificate authorities) in server side
Description: During Initial ssl handshake if client authentication is enabled, envoy server will request client certificate by sending CertificateRequest msg[1]. A list of the distinguished names [X501] of certificates in ca cert file will be sent to the client. According to the rfc5246 [1], the maximum size of collections of distinguished names is (2^16-1) bytes. Therefore, if the number of distinguished names is more than a certain amount, the handshake will fail.
But according to the rfc5246[1], the handshake step by TLS/SSL server side to send the list of the distinguished names [X501] of certificates is optional.
If the certificate_authorities list is empty, then the client MAY send any certificate of the appropriate ClientCertificateType, unless there is some external arrangement to the contrary.
Is there a way to send an empty list in this handshake step, instead of a list of existing distinguished names of certificates?
Thanks!