envoyproxy / envoyproxy/nighthawk
Make HTTP/3 Quic skip certificate verification
- Dominant language
- C++
- Stars
- 414
- Forks
- 95
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 11
Description
The current implementation of HTTP/3 Quic in Nighthawk reuses Envoy's `Http3::ConnectionPool` which has a hardcoded Quic's `EnvoyQuicProofVerifier`. This means that a Quic connection can only be established if the requested hostname matches the one in the leaf server certificate.
This is different from how Nighthawk handles HTTPs with H1/H2 where certificate verification is skipped. The simplest solution might be to create our own instance of the H3 connection pool with the `TestProofVerifier` from [here](https://github.com/envoyproxy/envoy/blob/e85a7f408c7baee8e1ed4af39a647c98ee5f2215/test/common/quic/test_proof_verifier.h#L9).
Contributor guide
Assessment
This issue has not been assessed yet.