Dynamic Per-Connection Certificates for QUIC in Envoy
#42 063 ouverte le 17 nov. 2025
Métriques du dépôt
- Stars
- (27 997 stars)
- Métriques de merge PR
- (Merge moyen 8j) (378 PRs mergées en 30 j)
Description
Hi all,
I’m exploring a setup where Envoy should present different TLS certificates on a per-QUIC-connection basis, depending on the SNI. Because some clients use ECH, the inner SNI may be encrypted, id like to instead infer the intended SNI from dynamic metadata we set at the listener filter.
A couple of questions:
Is there a recommended approach for selecting certificates dynamically for QUIC based on per-connection metadata (rather than the SNI visible to Envoy)?
Is there any experimental support or planned API to give the QUIC handshake access to FilterState, dynamic metadata, or similar Conn-level information during certificate selection?
Any guidance, design pointers, or examples would be greatly appreciated. Thanks!