kubernetes-sigs/aws-load-balancer-controller

Adding default certificate to the certificate list for SNI client connections

开放

#4,090 创建于 2025年3月13日

 (8 条评论) (2 个反应) (0 位负责人)Go (1,644 个派生)auto 404
good first issue

仓库指标

星标
 (4,317 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

Describe the feature you are requesting Scenarios in controller certificate auto-discovery;

  • where different encryption certificate (ECC, RSA) are auto-discovered
  • the ECC certificate is discovered first and in the LB model is created as the default certificate
  • the RSA encyption certificate is discovered ...and any other certificate, and added to the certificate ilst
  • From the ALB documentation, however, the default certificate is never used when a client request specifies the SNI and there is a certificate list
  • client attempting to negotiate ECC cipher suite with an ALB only checking only the certificate list fails TLS negotiation

Motivation

  • the ALB spec would seem to expect the default certificate to also be added to the certificate list

Describe the proposed solution you'd like

  • Add the default certificate also to the certificate list. Perhaps appending the certificate twice?

Contribution Intention (Optional)

  • Yes, I am willing to contribute a PR to implement this feature

贡献者指南