Support skipping certificate verification when establishing a Quic connection
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 430
Description
Envoys seems to skip certificate verifications by default as documented [in the API](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/api/envoy/extensions/transport_sockets/tls/v3/tls.proto#L34-L37).
However the Quic implementation of the [createQuicNetworkConnection](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/source/common/quic/client_connection_factory_impl.cc#L56) function currently doesn't take in any configuration and always uses the [EnvoyQuicProofVerifier](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/source/common/quic/client_connection_factory_impl.cc#L36).
This prevents establishment of Quic connection in load testing applications where we might be running with test / bogus certificates. This might also be affecting other use cases, so hoping to start a discussion whether this is something we want to improve by allowing a configuration that skips the certificate verification.
Contributor guide
Assessment
This issue has not been assessed yet.