envoyproxy/envoy

Dynamic Per-Connection Certificates for QUIC in Envoy

Open

#42,063 创建于 2025年11月17日

在 GitHub 查看
 (1 评论) (0 反应) (0 负责人)C++ (27,997 star) (5,373 fork)batch import
enhancementhelp wanted

描述

Hi all,

I’m exploring a setup where Envoy should present different TLS certificates on a per-QUIC-connection basis, depending on the SNI. Because some clients use ECH, the inner SNI may be encrypted, id like to instead infer the intended SNI from dynamic metadata we set at the listener filter.

A couple of questions:

Is there a recommended approach for selecting certificates dynamically for QUIC based on per-connection metadata (rather than the SNI visible to Envoy)?

Is there any experimental support or planned API to give the QUIC handshake access to FilterState, dynamic metadata, or similar Conn-level information during certificate selection?

Any guidance, design pointers, or examples would be greatly appreciated. Thanks!

贡献者指南

技术栈
cpp
领域
backendinfrastructuresecurityperformance
议题类型
research
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
5
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
over 1 week
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
fresh
清晰度议题是否清楚说明期望改动、验收标准和下一步。
needs investigation
前置要求
Understanding of Envoy proxy internalsKnowledge of TLS/QUIC handshake
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
10
研究方向
Investigate how Envoy's QUIC handshake can access per connection metadata like FilterState or dynamic metadata for certificate selection. Explore the existing certificate selection mechanisms (e.g., SdsConfig, static certs) and assess feasibility of extending them. Examine source code in source/common/quic/ for hooks during handshake. Consider documented limitations and engage with maintainers on design alternatives.