diff --git a/.licenserc.yaml b/.licenserc.yaml index 7164223ce39f..041a73feee2c 100644 --- a/.licenserc.yaml +++ b/.licenserc.yaml @@ -31,6 +31,7 @@ header: - '**/*.sse' - '**/*.key' - '**/*.crt' + - '**/*.crl' - '**/*.pem' - '**/*.pb.go' - '**/pnpm-lock.yaml' diff --git a/.requirements b/.requirements index bd5f61e9df09..dc4fcd4e749f 100644 --- a/.requirements +++ b/.requirements @@ -17,5 +17,5 @@ APISIX_PACKAGE_NAME=apisix -APISIX_RUNTIME=1.4.0 +APISIX_RUNTIME=1.4.1 APISIX_DASHBOARD_COMMIT=fa2fd0f60f8afffb096476333b9ba63b4c518fa3 diff --git a/apisix/cli/ngx_tpl.lua b/apisix/cli/ngx_tpl.lua index d872ff3b56eb..b9c69809f3cc 100644 --- a/apisix/cli/ngx_tpl.lua +++ b/apisix/cli/ngx_tpl.lua @@ -897,6 +897,7 @@ http { {% if ssl.ssl_trusted_certificate ~= nil then %} proxy_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *}; + grpc_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *}; {% end %} # opentelemetry_set_ngx_var starts diff --git a/ci/linux-install-openresty.sh b/ci/linux-install-openresty.sh index a2e09ec988b9..8078e04a673d 100755 --- a/ci/linux-install-openresty.sh +++ b/ci/linux-install-openresty.sh @@ -61,7 +61,7 @@ else sudo apt-get -y update --fix-missing sudo apt-get install -y build-essential gcc g++ cpanminus libxml2-dev libxslt-dev - if [ "$APISIX_RUNTIME" != "1.4.0" ]; then + if [ "$APISIX_RUNTIME" != "1.4.1" ]; then echo "Please update the apisix-runtime-debug checksum for APISIX_RUNTIME=$APISIX_RUNTIME" >&2 exit 1 fi @@ -69,11 +69,11 @@ else case "$ARCH" in x86_64|amd64) DEB_ARCH="amd64" - EXPECTED_SHA256="09d979543e65d6b16994d754f55ea759fe558fbb824fa8aed2ecd72a139b91b4" + EXPECTED_SHA256="c2c40dd7e86f6494c79f31433d840de9fa552491c8c6cddd49d237854aa5a4a1" ;; arm64|aarch64) DEB_ARCH="arm64" - EXPECTED_SHA256="d5803bd4c793332f0412968a85407a498de3b85c372edb65fcd0019aaaf05990" + EXPECTED_SHA256="1b337e0d068933f7c13c1d66002dd9e65b410e4ae8556c3362a8bc42a6ff7f8c" ;; *) echo "Unsupported architecture: $ARCH" >&2 diff --git a/docs/en/latest/admin-api.md b/docs/en/latest/admin-api.md index f3e48ca6d61a..7fd60a602d44 100644 --- a/docs/en/latest/admin-api.md +++ b/docs/en/latest/admin-api.md @@ -1059,7 +1059,7 @@ To use mTLS to communicate with Upstream, you can use the `tls.client_cert/key` Or you can reference SSL object by `tls.client_cert_id` to set SSL cert and key. The SSL object can be referenced only if the `type` field is `client`, otherwise the request will be rejected by APISIX. In addition, only `cert` and `key` will be used in the SSL object. -To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set: +To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set. In the latter case, a CRL configured in nginx with `proxy_ssl_crl` (`grpc_ssl_crl` for gRPC) is also checked: ```json { diff --git a/docs/zh/latest/admin-api.md b/docs/zh/latest/admin-api.md index b8f3bd82b753..0be2e5911752 100644 --- a/docs/zh/latest/admin-api.md +++ b/docs/zh/latest/admin-api.md @@ -1063,7 +1063,7 @@ APISIX 支持两种不同的方式来代理 WebSocket 连接，二者不能混 - `scheme` 可以设置成 `tls`，表示 `TLS over TCP`。 - `tls.client_cert/key` 可以用来跟上游进行 mTLS 通信。他们的格式和 SSL 对象的 `cert` 和 `key` 一样。 - `tls.client_cert_id` 可以用来指定引用的 SSL 对象。只有当 SSL 对象的 `type` 字段为 client 时才能被引用，否则请求会被 APISIX 拒绝。另外，SSL 对象中只有 `cert` 和 `key` 会被使用。 -- `tls.verify` 设置为 `true` 时校验上游返回的证书；不设置时沿用 nginx 的行为，即只有开启了 `proxy_ssl_verify` 才会校验。校验使用 `tls.ca_certs` 中的 CA 证书，未设置 `tls.ca_certs` 时使用 `config.yaml` 中的 `ssl_trusted_certificate`： +- `tls.verify` 设置为 `true` 时校验上游返回的证书；不设置时沿用 nginx 的行为，即只有开启了 `proxy_ssl_verify` 才会校验。校验使用 `tls.ca_certs` 中的 CA 证书，未设置 `tls.ca_certs` 时使用 `config.yaml` 中的 `ssl_trusted_certificate`，此时 nginx 中通过 `proxy_ssl_crl`（gRPC 为 `grpc_ssl_crl`）配置的 CRL 同样生效： ```json { diff --git a/t/certs/chain_root.crt b/t/certs/chain_root.crt new file mode 100644 index 000000000000..d941af731305 --- /dev/null +++ b/t/certs/chain_root.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDJzCCAg+gAwIBAgIUV8AvUI9ya6mg9hYhin2VQ84FFfMwDQYJKoZIhvcNAQEL +BQAwGjEYMBYGA1UEAwwPY2hhaW4gdGVzdCByb290MCAXDTI2MTAyODEwMDUzM1oY +DzIxMjYxMDA0MTAwNTMzWjAaMRgwFgYDVQQDDA9jaGFpbiB0ZXN0IHJvb3QwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCu55x4xUz64KTfiWVzPTPtFPHZ +Q5cq+7S7lwmf9H4jEJ0aZwmMnPZRwcIQqhiYSdmqsNNi9iRST50IJdeoeT9hygCx +6aS4zjKcLYHAayj30oxotMI6oTNkWmzz4Enf0AM4LhEqTuO+rO2/ZGYcdLEgWNb2 +1Tkm+HynIO0X+y9gML0mENdwz5u1c6ELWVZcNo6OCj2RZKWpAMX7BoclRr3NSOQ1 +UziXLOsHjfarkfKqi5vsoJ7S35AMNpUdcfBaUC4FvgMIeVje6kV+2m/Y07L57MaD +jRA4/K7QDtbFbquVFA3fgWNqIyrUgzA1vGxcWJWzgyeSbipp+J+qVUK1AjrpAgMB +AAGjYzBhMB0GA1UdDgQWBBRCSieNIEV+75ORkAIZLM1iwPaPizAfBgNVHSMEGDAW +gBRCSieNIEV+75ORkAIZLM1iwPaPizAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB +/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmvoFXFkn7jTFp6jYTYDfzY1ZAfsc +RDCvEGcrIWqyAJvgkro1jB5ddIz+ieeSx7A0G1Iq+5PdHFTYmaHnBO+cq0UySEs5 +eviLH1Z4seK4x/YEqWsBvW0rQO+zKovGVCbaPWRp8amVrHxgguC6hhq6tIYsb0L3 +yyIB0Ld+xsqXEbGKfmKhQmbSTBvedaH1DeoZw5PTHyAv/2Z5pZaXmyg63bxzLm/Q +kkSd/K8st79pY8NNzMytXCQdZ8a/gG4pOkhlFdcRzDSi+20aMc7ymHbQnwStoyR1 +aNbP2SvVTHQ/Kpsr9hIfz+1CYGJ3WewhzJwPeZWn8CusPiHY4qbKrC4rRw== +-----END CERTIFICATE----- diff --git a/t/certs/chain_server.crt b/t/certs/chain_server.crt new file mode 100644 index 000000000000..41c37fab9e56 --- /dev/null +++ b/t/certs/chain_server.crt @@ -0,0 +1,59 @@ +-----BEGIN CERTIFICATE----- +MIIDVTCCAj2gAwIBAgIJAP+eH2c2tXhnMA0GCSqGSIb3DQEBCwUAMCQxIjAgBgNV +BAMMGWNoYWluIHRlc3QgaW50ZXJtZWRpYXRlIDIwIBcNMjYxMDI4MTAwNTM0WhgP +MjEyNjEwMDQxMDA1MzRaMBsxGTAXBgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeDWeccAggvP1CaEP9X2GJtQJL +IKozdWmEmu6qXa98aSJMQ/Wps73TsrfH6Ki0KSLQ0XWgpb5geH4a23/537adZVob +/UUvQHbzOdoMuyh40uYhXXQ14znbmhmKRBbw8Orvbv2oX37dplB4BMlUkduu2D5z +0ojUyIRtxOgfbLW6cNT6baWj39K07gWhoWZaq3zJvOZtLewfSDBjWwTSsgnS1wqK +MhdP5ab8R0On5dPMRpV/lHVVTD9e5vs0hv/5cLbujxt7Rbt7ew91SsLX7osDh6kD +1bPnOKNuApJZV0PdEhF/CAly86h+mLANkC3eXdSwkjocCL3+j/maj2ZZ+XWLAgMB +AAGjgZAwgY0wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYI +KwYBBQUHAwEwGwYDVR0RBBQwEoIQYWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAW +gBStTAeW4Kwh9QmpPRcNCeOOemlUyDAdBgNVHQ4EFgQU4eFiuUwLKF22pRRI6OG8 +xobPSPIwDQYJKoZIhvcNAQELBQADggEBAE14MQx26iIFGvSNQgU/4JKgH1zF4IeF +6gzzFJCuWrWqA/FZA3EVkTH80I0BY8OuPNOuMMbLXOJIGIhhIVpuNY/X0PF1zbOG +8HRGjZM0TV0RYhE+yY6e8jkqdX1Z7vjpKbFyg7Og+gBy2okgfBuLZMtsgLIq3AUy +rR88FCpQghrAPHMCv8xgvyAzfNB0K3ksFtoZckmZLDgHJYhbFSYl8D8CHUrsXtJ6 +FMK3AKGE2A6Dbw/M1Bn9SvM0VcvqRd6A1LZ9P0jSawAxT9yn+juda5R1VrY5vF4f +i3WQu/L999wySw6MOOBHnbAVsmwlW9b7N26NhHpnLy0w5OnA6Z7tPHY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDLzCCAhegAwIBAgIIfr/Ihc1XqtMwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UE +AwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlhdGUgMTAgFw0yNjEwMjgxMDA1MzRaGA8y +MTI2MTAwNDEwMDUzNFowJDEiMCAGA1UEAwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlh +dGUgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI3MAmgNUMfUWetK +OngY/jTkUFoDgygJQsER23I/I+n/cEB0xA9ee/nW/exVgyiGwDpDZEGdJ55ab4b3 +6G+HuYX8BxaBuOEUi7zeC/GKBzF50/qMVfIOmgUL3F6fFggy6oO89tHdTNAABK9x +kcLqo326+Q8SGbSr9YGnrblGJ2wGM+0siEZuiPbHqQf6uGR6hMOrid6otgHUH4l7 +8ZxX6GWBz4uCMVqTp3Azn1qpIxePH8+LNALdifHpJu3aVXbZrdWkB2K3pfem8RLw +UeTGjYXHUJIHajIb76gQGRs9Vk9nVU2mhghd83sB5mpFdhBfRjGTyAdt8rGxkG+C +tEDFKN0CAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw +HQYDVR0OBBYEFK1MB5bgrCH1Cak9Fw0J4456aVTIMB8GA1UdIwQYMBaAFEF2dgNc +oxWQWie24GufXP2oZrCZMA0GCSqGSIb3DQEBCwUAA4IBAQBUPLBMzI+eJt3g/YK7 +7wpxrxqSLmRXWi3MhnUoIAgwVqEKJXoQkXJN9AbAJqPhEHfT2Vh4rr9Kr88WdEf6 +BI0L2Y3h7ueqWJhLY7Nzf36kpBLkduRCsfQiCq5e2lnIuMtCxyaPO1bKgGSxkwmF +NPuyb1s616GWTNWplCaNIEfFfzj/f97RFL1KcHkDDVtGp9WUtEnIeZEJ28byyzEs +M/+qFIR8mFFmWPgWaZFs9aDWX9y+O2+pqzqhKQ+VJZjEINh6jFtGg61deWVhS2us +u7FtajgvJPkCkJ3PIQFZoV0vyZ19vnEwzpMqItL0rnsR17KQePIoaN8X1t47Spc8 +AKPE +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDJjCCAg6gAwIBAgIJAJ3OIOomSX9hMA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNV +BAMMD2NoYWluIHRlc3Qgcm9vdDAgFw0yNjEwMjgxMDA1MzNaGA8yMTI2MTAwNDEw +MDUzM1owJDEiMCAGA1UEAwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlhdGUgMTCCASIw +DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI899uziWcPXmK517MeXtocmspyZ +gC+ujJn3r/pvEmoUMiKv7Y1MR9S8dFrF2mS6fDyCE6+rBt3E1+6IQnga5D51rlOa +z4U4qRCQHDtuWE2Y7VXASdg7+LbJEFoCPXjvgBuR/ZDqonwEfwl14cqtxBUZys+6 ++102qnjoS02B4IzbN6ixyoACmJhcq5d7o1bZkwgqg5InF+zptAHLs7V5RrKAu6/g +02B4BjpsIPKIFlwGQeTPzZD30JcUvvWq79mnmqTebYz3N4jQwnneMJSbAzvcVI3Z +omBSVyfEcJFFZ0w+wb2wm86+J03zV9nxjPVzzyyVPPFFzfChCBLTOqcXHp0CAwEA +AaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE +FEF2dgNcoxWQWie24GufXP2oZrCZMB8GA1UdIwQYMBaAFEJKJ40gRX7vk5GQAhks +zWLA9o+LMA0GCSqGSIb3DQEBCwUAA4IBAQCW36wyL40+yVGyptZlkEcfRwcbzOnO +/PkR57BwY9uoHXZSgWg2hsJbga90lbPLqI6Ok1mDVSrBi98/0+rxEagw29mm9oys +KuVPE6II4QOhZMlNYAR3jy0gRiewrOEgEZeLe94IFEkPSNoebxYLaCLzyacc+Lk+ +0FsRTi90AP1oaPA7W9oVM1llTXwrndDh5nVrIajki25JKAO0NlqCDgpl8vJBNmiJ +Q8kqnQHHwA9OP7m/xKgZ1sTYkQw3YA3vhDqrtEclr7PGUDhfRZyb3sQhMGr6KnnY +1WcrNwCysZMoRMnej4C9X7pmOau6ShFaAFg2AM9jiKgi9EuQNWQH1HJC +-----END CERTIFICATE----- diff --git a/t/certs/chain_server.key b/t/certs/chain_server.key new file mode 100644 index 000000000000..288658b06fda --- /dev/null +++ b/t/certs/chain_server.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCeDWeccAggvP1C +aEP9X2GJtQJLIKozdWmEmu6qXa98aSJMQ/Wps73TsrfH6Ki0KSLQ0XWgpb5geH4a +23/537adZVob/UUvQHbzOdoMuyh40uYhXXQ14znbmhmKRBbw8Orvbv2oX37dplB4 +BMlUkduu2D5z0ojUyIRtxOgfbLW6cNT6baWj39K07gWhoWZaq3zJvOZtLewfSDBj +WwTSsgnS1wqKMhdP5ab8R0On5dPMRpV/lHVVTD9e5vs0hv/5cLbujxt7Rbt7ew91 +SsLX7osDh6kD1bPnOKNuApJZV0PdEhF/CAly86h+mLANkC3eXdSwkjocCL3+j/ma +j2ZZ+XWLAgMBAAECggEAHpC1EtnPmJUz3R3Q2DUT5c+ti93bTGxOZaiYszW+9C5Y +xar23US3VzNeuzhRN9Ykt4FqYBDtijaDHKqKS0ZqSHILRRJryMGMv2jWtFOVdhhD +DPzHtowk6kUY31ZfoWTV6kvqnh8pp6+8LBmw3bv/YgbLvRZgA9ZrVdcYlMsvMcjG +L/a8djMIgoyyyd0ARcGlKBJ3S/YQp+qRyzRN5c91G0cvMAGacj5kIPOv/ndwWsti +KdgvqeiKj8OUQS1VFa8Oe4V+CE8JVH1fr/vO+HkjOpxImvJMr85nLAPEy2BNA+Al +OPGj/BrcDUaDpYq8sCYEMG2OrpEEYMHjaqefsJXVUQKBgQDbS8c+4tS7Mjvzecx/ +gonD5pwRu5sHZTHwjsXK0rQkupOur+D3pXoVCmRjXXF28aBqwzve6HUJIIrL50dH +5EH/taI/5idwERayna6BHzopm+h0WUOvfrC6Vkx3moO24sIB27pEQhlxa+vrjrGu +g2XSILIlkz88GohWTUiygWp7RwKBgQC4gYHVOQjbCyzFoY3W6Yt3ARxmW+c7N/tP +WQElmMnsy757QhUfv+UUKOlcbgQUvVNfbgxd/NqtNWOTwWaJM2/+tu0RmSLylzgf +pxpb5Lxiny20QfZpruGx3E7KksVSo9aagMlopRmONT5sRBUw90skPqQG4J4kQOYQ +XVVcI2zNnQKBgQC9m+q9o/DdnpSZczFu+pZVbNp6tqRXo5ancTrxoHcj3rJ8cxPn +7Ar/kEm2ZIALoOXcCcyFcqZm6t03alSGg4TRLOIJr91fl1bxv0a33CE1AtndZ6UP +Y1I4+w8Ixu+lvLCUXMDT7fcDy5VjybA1vOTX529A7+zX8fT58b6uoRlJVwKBgAXJ +EdAkzLFJpWrBCRiPFC90GnbfNN33gGrZiJ6sLtC9BskIpm7rbnx2V/LtBDW+Rgn9 +AmhEEHtT7D5q1xNASKe9BqwBmEXxFfJwI/RztLCG+0DmvJpNwIf6N4JEnelcd9M6 +bJZabvW1l7J/ZAa4CmQljrEkg/DxFAW5V37fIX9FAoGAPRCIDwDQazdxl65fmnJc +GGH7mm7aWQb5UgMTSACS5NC3TO7G2TrqkI3OZ4J4AWW+sOwxYMQAleMAqILKvAz0 +NBjc/Jqu4a9pbiSDlv18VveNNiNS4oBo81IeOuJZZTmh8K3C1L85zpKvdZhYVTwW +aRUOeUorHIo+oTUy9E7upyk= +-----END PRIVATE KEY----- diff --git a/t/certs/crl_ca.crl b/t/certs/crl_ca.crl new file mode 100644 index 000000000000..8ff75ba73b43 --- /dev/null +++ b/t/certs/crl_ca.crl @@ -0,0 +1,11 @@ +-----BEGIN X509 CRL----- +MIIBiDByAgEBMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC2NybCB0ZXN0IGNh +Fw0yNjEwMjgwOTIwMzZaGA8yMTI2MTAwNDA5MjAzNlowFTATAgIQARcNMjYxMDI4 +MDkyMDM2WqAPMA0wCwYDVR0UBAQCAhABMA0GCSqGSIb3DQEBCwUAA4IBAQABq2Ui +90Wk9YxrrdK1HnTeGQwJozR8xvdS1RKTuLDEYeKs4MT4mNy61rqfoPw6U9xnI8At +fj5MbH+NqHGbb7Ged/DPji9y3FIB0Z2GBm+81pugzDtkzekQHZ8QN3HzhlGN+rZw +bgpsRpiII1vfUc3NGRA8kEYbAG0QgWNzeb4LB9kuQxmlDBdT4gKy1dn4gLWpRFXQ +q8NUPZh3m/tO8jdSGCHwxivLaEqRYeW0QJ2AXpU6uMhoD0/ieSw2mvmPDCsDMhsv +XGDfmvH4Qfv33s1JHzy9olHZpWgjfmWF0Auggwc1cq3pPjU5A+bhzB42b1So3jJU +GDa6f93QGCZCH038 +-----END X509 CRL----- diff --git a/t/certs/crl_ca.crt b/t/certs/crl_ca.crt new file mode 100644 index 000000000000..7dedfea94352 --- /dev/null +++ b/t/certs/crl_ca.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIC/jCCAeagAwIBAgIUS9Q6AIR5tfZoO5DvzplICvbEvsUwDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLY3JsIHRlc3QgY2EwIBcNMjYxMDI4MDkyMDI3WhgPMjEy +NjEwMDQwOTIwMjdaMBYxFDASBgNVBAMMC2NybCB0ZXN0IGNhMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs9CNW7eJWC6A+K5xzPan3YKZjCegoPoOCblt +/pxXfSIt4ykZiniBKqb53B2Xk2LRyzyjmQ+i5lDPuSrlbCm76KFFsz80IUTsHurR +WE05zwXEkK84cQEOr+2KmN0ZYH3Y4IkaLenWLAWgtDcDuBOFySqntJNLN4VD59JT +kcnFH9+INvf1zxeGpqJnrLg/JyavQXIdE3PKTuk8pyFoJtjncTytD65QxoOGBfCI +UWSBaxGZ87czJ6yveI77jXK94DFE8YYqyIjugY1gPgaQhjAsr6EefdtrPBspcoVO ++HOmpID5PoQ87bjCGN8W5lWCC0RQqq/PhdLNO2o58fkjWJmzGwIDAQABo0IwQDAP +BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUXr7N+mjK +ffW0yu/x/leMZfNa0gQwDQYJKoZIhvcNAQELBQADggEBABG4yNESK5uRnztuIq0Y ++TFeR67+QmOr7uG9afceF68C+J9WXKLpHafKpt6LHJ3boPKfh3zSoOUM2F0hnFmw +e8v68MnyIBotHltDsp4828zSeAAJ5n9AvVVSAqTD6LlyMiSzxM/UWwNVU/tPOl/5 +6WbDZL3UMkTi/Vt4VCjfUhTA05DBu5MVRbIeQmMx1CpV4UFHeDYO+Cl2MtWbY6sM +0eEwVX8fxIm2pMb/8XyE3dJj21j7og/OWe1qo1aVM723co0cbGHquZ0SmKtyHg8U +u+1DaFCUVlo3yUVv66stBThO0CYsTH4roPy3DYrIJKNruWspDycp7sYZJ0BGnpop +QnE= +-----END CERTIFICATE----- diff --git a/t/certs/crl_revoked.crt b/t/certs/crl_revoked.crt new file mode 100644 index 000000000000..0ef50573c905 --- /dev/null +++ b/t/certs/crl_revoked.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDQDCCAiigAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLY3Js +IHRlc3QgY2EwIBcNMjYxMDI4MDkyMDM2WhgPMjEyNjEwMDQwOTIwMzZaMBsxGTAX +BgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQDAP1tWh1GxMl1XrthPldA6U6LbHGX5qq5UZ20t1JLrYW9v50cTSW6o +H4ncgPGRflb5YWmcwbmDTsBZeRAO4miA5Fyp9KB0eAveOT9iK8cjfDIWwEQ5v6nx +8b6bvEgHjn7W3JYy4ryPDqap/oCZsHw0Sjqr7nUQmR1L7L1wGKCgs1is6FZLs884 +FDwIRziPAnL17Dtyq4xzjuu1p5ouy0lFBns7cn1AacCop8EqgCpms6BR/OKt2zh1 +HlVkQYy/ZtZ2r58ELpc9CA2TBAcUEWWHKylTMTtDeyARQf5+RYBHcTpYw8wduhLA +s72FGZ4A+YK+NLAk60Vz1jV44p4H9sZLAgMBAAGjgZAwgY0wCQYDVR0TBAIwADAO +BgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGwYDVR0RBBQwEoIQ +YWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAWgBRevs36aMp99bTK7/H+V4xl81rS +BDAdBgNVHQ4EFgQUHJiX/wzAgCIYD2RPMKcnE8yxZiswDQYJKoZIhvcNAQELBQAD +ggEBADY8TfO/j+LmKp7Q4ESW+whfxInu3tIyYFyZPJTlWTP+59qMWjeTeyult4XA +0s7otvjOLoBu7O48qQ2lb448CmkzjIJjo2F8+yHfr/c5FIa7oY1MCiIjuRe5OZBr +h4BqQCsOcAXzTutO8JTPm+B7NMtynpzoKWKlwpS5U53RJ4iDNDSn/dHF5+b2Bias +6+vIczru4gxw016ps0ROrOJrurHORuQZe3tBjz3hZFNAIgj3jt5HOiv1fMCrQAUX +PZPyWG/FSQ4SbM6WXYyEE7qRgyhGW4GlL2fHkjGhkVhXSBQukEljbpPyY/Iqyw6S +zmeSug9y61+yKR81ULzknlLgGY0= +-----END CERTIFICATE----- diff --git a/t/certs/crl_revoked.key b/t/certs/crl_revoked.key new file mode 100644 index 000000000000..55ae4778a442 --- /dev/null +++ b/t/certs/crl_revoked.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDAP1tWh1GxMl1X +rthPldA6U6LbHGX5qq5UZ20t1JLrYW9v50cTSW6oH4ncgPGRflb5YWmcwbmDTsBZ +eRAO4miA5Fyp9KB0eAveOT9iK8cjfDIWwEQ5v6nx8b6bvEgHjn7W3JYy4ryPDqap +/oCZsHw0Sjqr7nUQmR1L7L1wGKCgs1is6FZLs884FDwIRziPAnL17Dtyq4xzjuu1 +p5ouy0lFBns7cn1AacCop8EqgCpms6BR/OKt2zh1HlVkQYy/ZtZ2r58ELpc9CA2T +BAcUEWWHKylTMTtDeyARQf5+RYBHcTpYw8wduhLAs72FGZ4A+YK+NLAk60Vz1jV4 +4p4H9sZLAgMBAAECggEAA4+o43tyOfQS4pLsktzVlJ8D/0cRZISS4iFgVl7/sbiG +Ve5U1Lihgh/DcAA7eVR7y/bP/AViqFoHGiEx+PSctvaD+On9JusqXR12XR0ufSvJ +yb4aBW/VeBPgUgY0117+XoCLj7m/gG7nC3MZcr9gLZ/KYnDyXjJX5pYmFDOAljl0 +C+Nra8AKqc+9Pnbo7yIlwwdNc5qBNZ7RYMCAjqBjV56SbdJR7QmnEI7seWuylafJ +6YIeE1qFj0SisuSiEyBiJe++CictJntYscR997O6tdxAtdzDGWjGOXSCIpPfqMW2 +k7S4OCUD3abEh1791HIIJZAkI3m5ty4sw8rnPXW0cQKBgQDlKtF2oSNC6Wf31P+8 +F0baaJJ/Ytb0OodEx/b1iQ7ZiLxtdNJd1OtlSm+e9G121U7zI7rgTkJ6InPERRoM +t7pWiYucEqlbh0Uqheo+ebeiQ+PNaAu7Zns5BhyXvVJ3HNZ8qL49ExVu5vxd8QZO +XQm2UjGDHU35uc/FsDedkkLfLQKBgQDWweK5CmoU++z+JcA7gnhZdsYFrSap6ORv +xTpHNBZGZx1Wp64X9sI8iT1mCizZPWMUqCLjRpZxMAq7ZU4YwLlOF8KX14mY/O6A +IKwvd9TTYC0XJk1c0nuNKcdwOZEkBZ+Ec9w+TkiyeJTAjQHEKTzabMuRfHeCXNei +ZniYojVmVwKBgQCSabPf1f2gT11EgspM0pZLDkqipnRtH0OzFwraPpHFO84fJGcO +2ez3DwKXjNSu+oNxZh+MFZP1UjOibv/AplWf2krfETEwsBDppRtOhRdkzXkqj9IH +DeemPBhifevE/CCxDmJUxO+JpnwQTOBZiqmc2ZCWk09xQFzVkctGmd6tlQKBgDlC +pPL1hedmbIAvDJxRY0lnU9E7o611/UKX8bv+dVn8MGRkfRTCpHODnC1S1TZvGbXu +Rq8WqRIw3wusLTCIYmAiEa5ut69k8SqUi5R0fPiHEj6z5bi0HmE7HIQdtUdHgIrO +YZDzSorbf73/WtM0s5cBnx2BdFP78TrJ26nGxjotAoGBAL6MUxmJkqa8RTM7jBlH +lyNqA4wgok5RisdAqY6IUBQnR393ESadZjrBD5bLCR5dJ+PfRbCjm3aGdjRytpC4 +c5BJ17YvWx7yKKfO5bVAYMAP7XzVLbpBd5oJN/3waIqPYwBEqmZGsuibf3+KQ4Ik +BE3bCv0ob+7AIuh0NwQhUN/n +-----END PRIVATE KEY----- diff --git a/t/certs/crl_server.crt b/t/certs/crl_server.crt new file mode 100644 index 000000000000..ab8aac531f14 --- /dev/null +++ b/t/certs/crl_server.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDQDCCAiigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLY3Js +IHRlc3QgY2EwIBcNMjYxMDI4MDkyMDI3WhgPMjEyNjEwMDQwOTIwMjdaMBsxGTAX +BgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQDKIgV2jw12zz4VYGrQX263JytLVC5DjXw7JtTE2KOfMKzXskCRQ5Do +naQuoxJmzQ+THRgxp3IvV9/HLmSjqtkdA+FNJY8uo/O4en/jCBQPVZpEkRcQ5cG9 +AMXQK4qZSW3UPffDJw/canDZBMbyj0u8Ma3dzbcBu1jWBIsTFJ0FnRT2QQ8r9B8I +BYcCskYo3jsFZXnjJqULckQ2zKY+M9sROp5pLPBwuWBOjBlI8QLyWgjEbk1Jmk24 +m6IzWyFUyYFOAGA2zjtGWZekHcrnfj3RaQhmRg+oEIZO+KHwp2K6qJB4s5R+XYf3 +G33mpXxFfPkFY9ha/05Y+KTKKDY2QtL3AgMBAAGjgZAwgY0wCQYDVR0TBAIwADAO +BgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGwYDVR0RBBQwEoIQ +YWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAWgBRevs36aMp99bTK7/H+V4xl81rS +BDAdBgNVHQ4EFgQU5xSKo8tPSDKyVgSp/7V0aKYYil8wDQYJKoZIhvcNAQELBQAD +ggEBACjL7rqFYwohXoX7wc3MKXGmK6X18JKZJ1xgfXmlWQlgCE8M4py0gdQ1aNrB +QwY9IFxCa/vWFDnfdcS6NmsA/GIufdEjN+4M7OklN4/IgHlYJFXKnlHu6OUNqj/N +FXI0sjCqIigWSTy2fheW3pAxfFONPL/T0Sg1SWJxCGCg7wUrqbgqIjIbqulPqlZi +N/diQD07sFaL0Ofp0o+GIOAxmfSa1SCtmyTUHvkJ+0QveKd9yko3YQdKpVkDUWes +12MSh2QHWC+i7i0GrVvv+bDNBR1aGaegwQG9US8jkTzAMSx5JsBm12Q5HpEgbBKG +wOIJFK+w5LK7G1GrrWwx6Z1R71Q= +-----END CERTIFICATE----- diff --git a/t/certs/crl_server.key b/t/certs/crl_server.key new file mode 100644 index 000000000000..768302127b00 --- /dev/null +++ b/t/certs/crl_server.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDKIgV2jw12zz4V +YGrQX263JytLVC5DjXw7JtTE2KOfMKzXskCRQ5DonaQuoxJmzQ+THRgxp3IvV9/H +LmSjqtkdA+FNJY8uo/O4en/jCBQPVZpEkRcQ5cG9AMXQK4qZSW3UPffDJw/canDZ +BMbyj0u8Ma3dzbcBu1jWBIsTFJ0FnRT2QQ8r9B8IBYcCskYo3jsFZXnjJqULckQ2 +zKY+M9sROp5pLPBwuWBOjBlI8QLyWgjEbk1Jmk24m6IzWyFUyYFOAGA2zjtGWZek +Hcrnfj3RaQhmRg+oEIZO+KHwp2K6qJB4s5R+XYf3G33mpXxFfPkFY9ha/05Y+KTK +KDY2QtL3AgMBAAECggEAAiR816uJ16nispSkYokLF2M8O5Qs2V0f5VCdY2jDHeYv +hCnI3Wv7QTv1MuQE8eoChutWslAKuc29+tKBu+piWsMLxFGS7vT17w1SsF60N7q5 +4+LV0mwHswUrE5sii6ASS0miMq4F+67Ke20S3sdTZNnx9IPrCK2qXLpiRFWCRJOc +2RHGiP30jnEo0jfyPF3E55+fvooVeWigPisONqYo1fVn6Z8sfLpm8oEYatKyhKqC +asoQmehFiiP25PU9cd1HDHb5dywNDtwKUWoG55douFrYTZpXy6b3ELxlAnQ0hTl7 +VnIm9DOmSpaKwkHBj21/ARRLlY0Mu5usBeDhPD4noQKBgQDoxFlRlUTwWoPsgJ50 +GqOmLRQvMZ2dgr+6VsH19HNivKsqSnHFUGT8Z3qA9xnbTs8/tO6AYh9mnHxVli3y +yKjc+GBLis7Q3Wd3rzcYFnD06c4INWtUIFrV1Gq39sQ62BQDKKOspSPYm6xGKNDL +fEQjp1B9Eu/TlkJ45PBoYwIyAwKBgQDeTulcQvjOtzFKpSw4op5Z3A23eFrWF+SK +Uc4cQEdLFNb+jSIRnI/2+jdWBApA7tVRrBD6Hq6zHoQjfa4EIP1rL4lCEaRtwnXe +EcOxupRLctJIQZF+2T3HMQyInomdSQdS3gIffN9WlCAadOtcU6SHRkHKob8JgTYP +zsYiatEi/QKBgA6Ik/sgEtnfDPWrYjlloGozzlrUAj9fdpEv8ZRl2v6DQTy2wTvM +tUF9RIzg4OBsn0wfA/VIKyXBB5JgeiX6mXCSoZCV7ivkZx119z6tyAfCwXaJv1XV +X1aSmMc7xSzXaQh5dR7GgOJ5ddw7mC3caHTBcakdkZPogeYChXA/Hlf5AoGAGs0O +qzXTwzAovCQPocBRMOorqSvUX60/u0FDhPpm3fFkPgoLym3CmXbvBuqzxcJFa3RA +E7dxPlz2d0Tmns7PXoW7mYCA/06LYTtpCVtCF5p/KYDmJpHQNdx+81WRp6mvPVlQ +jjVCw7BV8nqYCWh4FGru8ZvwaRfvyZYXIv0Xu40CgYAVdsKs6xAhC6TUltlyoNli +J1Yi5PalFQK5YY5S1AeHKVVX29k7kS1M6IXgWQ7nUEuAvz5Txcs7jOvTaaOYQI9F +ltbhQIlIWmYWLGEuUS4uGYP8evyOJK8xhDHjn+5AjccBEheCeB6FR+O38xAX5NPP +bCqKAFUIdaGndXwc1rjiRA== +-----END PRIVATE KEY----- diff --git a/t/cli/test_upstream_mtls.sh b/t/cli/test_upstream_mtls.sh index bb6c41a2e76a..2c37d1ede08b 100755 --- a/t/cli/test_upstream_mtls.sh +++ b/t/cli/test_upstream_mtls.sh @@ -209,3 +209,83 @@ sleep 0.1 make stop echo "passed: connection to upstream with mTLS success" + +# test tls.verify alone with proxy_ssl_verify off +git checkout conf/config.yaml + +for trusted_cert in apisix.crt apisix_ecc.crt; do +echo " +deployment: + admin: + admin_key: + - name: admin + key: edd1c9f034335f136f87ad84b625c8f1 + role: admin +apisix: + ssl: + ssl_trusted_certificate: t/certs/$trusted_cert +nginx_config: + http_configuration_snippet: | + server { + listen 1983 ssl; + server_name test.com; + ssl_certificate ../t/certs/apisix.crt; + ssl_certificate_key ../t/certs/apisix.key; + location /hello { + return 200 \"hello world\"; + } + } +" > conf/config.yaml + +rm logs/error.log || true +make init + +if ! grep -q "grpc_ssl_trusted_certificate " conf/nginx.conf; then + echo "failed: grpc_ssl_trusted_certificate is not rendered from ssl_trusted_certificate" + exit 1 +fi + +make run +sleep 1 + +code=$(curl -k -s -o /dev/null -w %{http_code} http://127.0.0.1:9180/apisix/admin/routes/1 -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "uri": "/hello", + "upstream": { + "pass_host": "rewrite", + "nodes": { + "127.0.0.1:1983": 1 + }, + "scheme": "https", + "upstream_host": "test.com", + "type": "roundrobin", + "tls": { + "verify": true + } + } +}') + +if [ ! "$code" -eq 200 ] && [ ! "$code" -eq 201 ]; then + make stop + echo "failed: failed to create the route, got $code" + exit 1 +fi + +sleep 1 + +code=$(curl -v -k -i -m 20 -o /dev/null -s -w %{http_code} http://127.0.0.1:9080/hello) + +make stop + +if [ "$trusted_cert" = "apisix.crt" ] && [ ! $code -eq 200 ]; then + echo "failed: tls.verify should verify against ssl_trusted_certificate, got $code" + exit 1 +fi + +if [ "$trusted_cert" = "apisix_ecc.crt" ] && [ ! $code -eq 502 ]; then + echo "failed: tls.verify should reject a certificate ssl_trusted_certificate does not cover, got $code" + exit 1 +fi +done + +echo "passed: tls.verify uses ssl_trusted_certificate with proxy_ssl_verify off" diff --git a/t/node/upstream-tls-trusted-ca.t b/t/node/upstream-tls-trusted-ca.t new file mode 100644 index 000000000000..db2c673e8641 --- /dev/null +++ b/t/node/upstream-tls-trusted-ca.t @@ -0,0 +1,372 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +use t::APISIX; + +my $nginx_binary = $ENV{'TEST_NGINX_BINARY'} || 'nginx'; +my $version = eval { `$nginx_binary -V 2>&1` }; + +if ($version !~ m/\/apisix-nginx-module/) { + plan(skip_all => "apisix-nginx-module not installed"); +} else { + plan('no_plan'); +} + +repeat_each(1); +no_long_string(); +no_root_location(); +no_shuffle(); +log_level("info"); + +add_block_preprocessor(sub { + my ($block) = @_; + + # nginx.conf renders proxy_ssl_trusted_certificate and + # grpc_ssl_trusted_certificate from apisix.ssl.ssl_trusted_certificate, + # but proxy_ssl_verify and grpc_ssl_verify stay off + my $static_verify = ""; + if ($block->static_verify) { + $static_verify = <<_EOC_; +proxy_ssl_verify on; +grpc_ssl_verify on; +_EOC_ + } + + # the CRL only covers crl_ca.crt, so the chain_root.crt cases go without it + my $trusted = <<_EOC_; +proxy_ssl_trusted_certificate ../../certs/crl_ca.crt; +grpc_ssl_trusted_certificate ../../certs/crl_ca.crt; +proxy_ssl_crl ../../certs/crl_ca.crl; +grpc_ssl_crl ../../certs/crl_ca.crl; +_EOC_ + if ($block->chain) { + $trusted = <<_EOC_; +proxy_ssl_trusted_certificate ../../certs/chain_root.crt; +grpc_ssl_trusted_certificate ../../certs/chain_root.crt; +_EOC_ + } + + my $http_config = <<_EOC_; +$trusted +$static_verify + +server { + listen 8770 ssl; + http2 on; + ssl_certificate ../../certs/crl_server.crt; + ssl_certificate_key ../../certs/crl_server.key; + + location / { + return 200 'ok\\n'; + } +} + +server { + listen 8771 ssl; + http2 on; + ssl_certificate ../../certs/crl_revoked.crt; + ssl_certificate_key ../../certs/crl_revoked.key; + + location / { + return 200 'ok\\n'; + } +} + +server { + listen 8772 ssl; + http2 on; + ssl_certificate ../../certs/mtls_server.crt; + ssl_certificate_key ../../certs/mtls_server.key; + + location / { + return 200 'ok\\n'; + } +} + +server { + listen 8773 ssl; + http2 on; + # leaf and two intermediates + ssl_certificate ../../certs/chain_server.crt; + ssl_certificate_key ../../certs/chain_server.key; + + location / { + return 200 'ok\\n'; + } +} +_EOC_ + + $block->set_value("http_config", $http_config); + + my $routes = "routes:\n"; + my %ports = (good => 8770, revoked => 8771, untrusted => 8772, chain => 8773); + my $id = 0; + for my $scheme ("https", "grpcs") { + for my $name (sort keys %ports) { + for my $verify ("verify", "noverify", "default") { + $id++; + my $tls = ""; + if ($verify ne "default") { + my $on = $verify eq "verify" ? "true" : "false"; + $tls = " tls:\n verify: $on\n"; + } + $routes .= <<_EOC_; + - id: $id + uri: /$scheme/$verify/$name + upstream: + scheme: $scheme + type: roundrobin + pass_host: rewrite + upstream_host: admin.apisix.dev + nodes: + "127.0.0.1:$ports{$name}": 1 +$tls +_EOC_ + } + } + } + $routes .= "#END\n"; + + $block->set_value("apisix_yaml", $routes); + + if (!$block->no_error_log && !$block->error_log) { + $block->set_value("no_error_log", "[error]\n[alert]"); + } +}); + +run_tests; + +__DATA__ + +=== TEST 1: https, tls.verify, certificate signed by a trusted CA +--- request +GET /https/verify/good +--- response_body +ok + + + +=== TEST 2: https, tls.verify, revoked certificate +--- request +GET /https/verify/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 3: https, tls.verify, certificate signed by an untrusted CA +--- request +GET /https/verify/untrusted +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \(2[01]:unable to (get local issuer certificate|verify the first certificate)\)/ + + + +=== TEST 4: https, tls.verify unset, no verification +--- pipelined_requests eval +["GET /https/default/good", "GET /https/default/revoked", "GET /https/default/untrusted"] +--- response_body eval +["ok\n", "ok\n", "ok\n"] + + + +=== TEST 5: https, static verify, tls.verify, certificate signed by a trusted CA +--- static_verify: true +--- request +GET /https/verify/good +--- response_body +ok + + + +=== TEST 6: https, static verify, tls.verify, revoked certificate +--- static_verify: true +--- request +GET /https/verify/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 7: https, static verify, tls.verify unset, revoked certificate +--- static_verify: true +--- request +GET /https/default/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 8: grpcs, tls.verify, certificate signed by a trusted CA +--- request +GET /grpcs/verify/good +--- response_body +ok + + + +=== TEST 9: grpcs, tls.verify, revoked certificate +--- request +GET /grpcs/verify/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 10: grpcs, tls.verify, certificate signed by an untrusted CA +--- request +GET /grpcs/verify/untrusted +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \(2[01]:unable to (get local issuer certificate|verify the first certificate)\)/ + + + +=== TEST 11: grpcs, tls.verify unset, no verification +--- pipelined_requests eval +["GET /grpcs/default/good", "GET /grpcs/default/revoked", "GET /grpcs/default/untrusted"] +--- response_body eval +["ok\n", "ok\n", "ok\n"] + + + +=== TEST 12: grpcs, static verify, tls.verify, certificate signed by a trusted CA +--- static_verify: true +--- request +GET /grpcs/verify/good +--- response_body +ok + + + +=== TEST 13: grpcs, static verify, tls.verify, revoked certificate +--- static_verify: true +--- request +GET /grpcs/verify/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 14: https, tls.verify false, no verification +--- request +GET /https/noverify/untrusted +--- response_body +ok + + + +=== TEST 15: https, static verify, tls.verify false, no verification +--- static_verify: true +--- request +GET /https/noverify/untrusted +--- response_body +ok + + + +=== TEST 16: https, tls.verify, two intermediates, no depth limit +--- chain: true +--- request +GET /https/verify/chain +--- response_body +ok + + + +=== TEST 17: https, static verify, tls.verify, default verify depth +--- static_verify: true +--- chain: true +--- request +GET /https/verify/chain +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \((20:unable to get local issuer certificate|22:certificate chain too long)\)/ + + + +=== TEST 18: https, static verify, tls.verify unset, default verify depth +--- static_verify: true +--- chain: true +--- request +GET /https/default/chain +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \((20:unable to get local issuer certificate|22:certificate chain too long)\)/ + + + +=== TEST 19: grpcs, tls.verify false, no verification +--- request +GET /grpcs/noverify/untrusted +--- response_body +ok + + + +=== TEST 20: grpcs, static verify, tls.verify false, no verification +--- static_verify: true +--- request +GET /grpcs/noverify/untrusted +--- response_body +ok + + + +=== TEST 21: grpcs, static verify, tls.verify unset, revoked certificate +--- static_verify: true +--- request +GET /grpcs/default/revoked +--- error_code: 502 +--- error_log +upstream SSL certificate verify error: (23:certificate revoked) + + + +=== TEST 22: grpcs, tls.verify, two intermediates, no depth limit +--- chain: true +--- request +GET /grpcs/verify/chain +--- response_body +ok + + + +=== TEST 23: grpcs, static verify, tls.verify, default verify depth +--- static_verify: true +--- chain: true +--- request +GET /grpcs/verify/chain +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \((20:unable to get local issuer certificate|22:certificate chain too long)\)/ + + + +=== TEST 24: grpcs, static verify, tls.verify unset, default verify depth +--- static_verify: true +--- chain: true +--- request +GET /grpcs/default/chain +--- error_code: 502 +--- error_log eval +qr/upstream SSL certificate verify error: \((20:unable to get local issuer certificate|22:certificate chain too long)\)/