envoyproxy/envoy

Dynamic Per-Connection Certificates for QUIC in Envoy

Open

#42,063 opened on 2025年11月17日

GitHub で見る
 (1 comment) (0 reactions) (0 assignees)C++ (27,997 stars) (5,373 forks)batch import
enhancementhelp wanted

説明

Hi all,

I’m exploring a setup where Envoy should present different TLS certificates on a per-QUIC-connection basis, depending on the SNI. Because some clients use ECH, the inner SNI may be encrypted, id like to instead infer the intended SNI from dynamic metadata we set at the listener filter.

A couple of questions:

Is there a recommended approach for selecting certificates dynamically for QUIC based on per-connection metadata (rather than the SNI visible to Envoy)?

Is there any experimental support or planned API to give the QUIC handshake access to FilterState, dynamic metadata, or similar Conn-level information during certificate selection?

Any guidance, design pointers, or examples would be greatly appreciated. Thanks!

コントリビューターガイド

技術スタック
cpp
領域
backendinfrastructuresecurityperformance
Issue 種別
research
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
5
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
over 1 week
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
fresh
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
needs investigation
前提条件
Understanding of Envoy proxy internalsKnowledge of TLS/QUIC handshake
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
10
調査方針
Investigate how Envoy's QUIC handshake can access per connection metadata like FilterState or dynamic metadata for certificate selection. Explore the existing certificate selection mechanisms (e.g., SdsConfig, static certs) and assess feasibility of extending them. Examine source code in source/common/quic/ for hooks during handshake. Consider documented limitations and engage with maintainers on design alternatives.
Dynamic Per-Connection Certificates for QUIC in Envoy · envoyproxy/envoy#42063 | Good First Issue