TLS should do cert verification by default
Open
area/tls
enhancement
no stalebot
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 430
Description
Change Envoy to reject upstream TLS unless
a) Valid cert chain is on by default
b) At least one of a) cert pinning, b) matching a specific SAN, c) auto SAN, etc. is configured.
or
a new bool allow_dangerous_tls_without_certificate_validation is set
See discussion on https://github.com/envoyproxy/envoy/issues/17700
https://github.com/envoyproxy/envoy/pull/18033
Contributor guide
Assessment
This issue has not been assessed yet.