certprovider

Documentation

Overview

Package certprovider implements the envoy.service.tls.v3. CertificateProviderService that Envoy's grpc_certificate_provider custom handshaker calls during MITM TLS termination. It mints leaf certs on the fly for the SNI observed in the ClientHello, signed by a per-EgressGateway CA Secret.

EgressGateway identity is carried over the HTTP/2 :authority pseudo-header (the apoxy-private fork of grpc_certificate_provider plumbs the configured `authority` field through grpc::ClientContext::set_authority per call). The egidentity gRPC interceptor parses :authority off incoming metadata and stashes the EG identity on ctx; we read it back here.

Index

• type Server
  • func New(c client.Client) *Server
  • func (s *Server) FetchCertificate(ctx context.Context, req *tlsv3.CertificateRequest) (*tlsv3.CertificateResponse, error)

Types

type Server

type Server struct {
	tlsv3.UnimplementedCertificateProviderServiceServer
	// contains filtered or unexported fields
}

Server implements envoy.service.tls.v3.CertificateProviderServiceServer.

func New

func New(c client.Client) *Server

New constructs a handshaker gRPC server backed by the given client.

func (*Server) FetchCertificate

func (s *Server) FetchCertificate(ctx context.Context, req *tlsv3.CertificateRequest) (*tlsv3.CertificateResponse, error)

FetchCertificate returns a leaf cert + key for the requested SNI, signed by the EgressGateway CA identified via gRPC metadata.