AlinsRan commented on code in PR #14113:
URL: https://github.com/apache/apisix/pull/14113#discussion_r4409214591
##########
apisix/upstream.lua:
##########
@@ -107,13 +136,19 @@ local function set_upstream_ssl_opts(up_conf)
end
end
+ local store, err
if tls.ca_certs then
- local store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
- create_trusted_store,
tls.ca_certs)
- if not store then
- return nil, err
- end
+ store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
+ create_trusted_store, tls.ca_certs)
+ elseif tls.verify then
+ store = default_trusted_store
Review Comment:
Fixed in the latest revision. The Lua default-store replacement has been
removed. APISIX now uses runtime 1.4.1, which includes
https://github.com/api7/apisix-nginx-module/pull/137: trusted CAs and CRLs are
loaded into NGINX's existing upstream SSL context even when static verification
is off, preserving the CRL entries and verification flags. This does not enable
verification or change the verification depth when static verification is off.
Added `t/node/upstream-tls-trusted-ca.t` coverage for both HTTPS and gRPCS,
including static verification on with a configured CRL and `tls.verify: true`
without `tls.ca_certs`: a valid certificate returns 200, and a revoked
certificate returns 502 with `certificate revoked`. The regression suite passes
in CI. Explicit `tls.ca_certs` retains its existing behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
