SSL handshake fails because of too many certificate authorities
#14.208 aberto em 30 de nov. de 2020
Métricas do repositório
- Stars
- (27.997 estrelas)
- Métricas de merge de PR
- (Mesclagem média 8d) (378 fundiu PRs em 30d)
Description
Title: Initial ssl handshake fails because the ca cert file contains too many certificates (e.g more than 500 certificate authorities) in server side
Description: During Initial ssl handshake if client authentication is enabled, envoy server will request client certificate by sending CertificateRequest msg[1]. A list of the distinguished names [X501] of certificates in ca cert file will be sent to the client. According to the rfc5246 [1], the maximum size of collections of distinguished names is (2^16-1) bytes. Therefore, if the number of distinguished names is more than a certain amount, the handshake will fail.
But according to the rfc5246[1], the handshake step by TLS/SSL server side to send the list of the distinguished names [X501] of certificates is optional.
If the certificate_authorities list is empty, then the client MAY send any certificate of the appropriate ClientCertificateType, unless there is some external arrangement to the contrary.
Is there a way to send an empty list in this handshake step, instead of a list of existing distinguished names of certificates?
Thanks!