kubernetes-sigs/aws-load-balancer-controller

Adding default certificate to the certificate list for SNI client connections

オープン

#4,090 opened on 2025/03/13

 (8 件のコメント) (2 件のリアクション) (0 人の担当者)Go (1,644 件のフォーク)auto 404
good first issue

Repository metrics

Stars
 (4,317 個のスター)
PR merge metrics
 (PR metrics pending)

説明

Describe the feature you are requesting Scenarios in controller certificate auto-discovery;

  • where different encryption certificate (ECC, RSA) are auto-discovered
  • the ECC certificate is discovered first and in the LB model is created as the default certificate
  • the RSA encyption certificate is discovered ...and any other certificate, and added to the certificate ilst
  • From the ALB documentation, however, the default certificate is never used when a client request specifies the SNI and there is a certificate list
  • client attempting to negotiate ECC cipher suite with an ALB only checking only the certificate list fails TLS negotiation

Motivation

  • the ALB spec would seem to expect the default certificate to also be added to the certificate list

Describe the proposed solution you'd like

  • Add the default certificate also to the certificate list. Perhaps appending the certificate twice?

Contribution Intention (Optional)

  • Yes, I am willing to contribute a PR to implement this feature

コントリビューターガイド