envoyproxy / envoyproxy/envoy

Support skipping certificate verification when establishing a Quic connection

Open
#17,700 11 comments 0 reactions 0 assignees View on GitHub
area/quic help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 22h
Merged PRs (30d)
430

Description

Envoys seems to skip certificate verifications by default as documented [in the API](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/api/envoy/extensions/transport_sockets/tls/v3/tls.proto#L34-L37).

However the Quic implementation of the [createQuicNetworkConnection](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/source/common/quic/client_connection_factory_impl.cc#L56) function currently doesn't take in any configuration and always uses the [EnvoyQuicProofVerifier](https://github.com/envoyproxy/envoy/blob/a230dbd3041161f9e38f9fb0f6ee178e785e07f7/source/common/quic/client_connection_factory_impl.cc#L36).

This prevents establishment of Quic connection in load testing applications where we might be running with test / bogus certificates. This might also be affecting other use cases, so hoping to start a discussion whether this is something we want to improve by allowing a configuration that skips the certificate verification.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.