AlinsRan opened a new pull request, #14113:
URL: https://github.com/apache/apisix/pull/14113
### Description
An upstream that sets `tls.verify: true` without `tls.ca_certs` fails with
`upstream SSL certificate verify error: (20:unable to get local issuer
certificate)` for every upstream certificate, including ones signed by a CA
listed in `apisix.ssl.ssl_trusted_certificate`. Turning on `proxy_ssl_verify`
in nginx makes the same request succeed.
Root cause: nginx loads `proxy_ssl_trusted_certificate` into the upstream
SSL context only when `proxy_ssl_verify` is on at configuration time. APISIX
renders `proxy_ssl_trusted_certificate` but leaves `proxy_ssl_verify` off, so
when `tls.verify` enables verification per request, the handshake is verified
against an empty trusted store.
This PR loads `apisix.ssl.ssl_trusted_certificate` into an X509 store once
per worker and applies it through `set_ssl_trusted_store` when `tls.verify` is
`true` and `tls.ca_certs` is not set. This matches what the Admin API docs
already describe ("checked against `tls.ca_certs`, or against
`ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set"),
so no docs change is needed. The same path covers `grpcs`, since
`set_upstream_ssl_opts` is also applied after the redirect to `@grpc_pass`.
Tests:
- `t/cli/test_upstream_mtls.sh`: new case with the real rendered
`nginx.conf` and no `proxy_ssl_verify` snippet. `tls.verify: true` now returns
200 when `ssl_trusted_certificate` covers the upstream certificate (502 before
this change) and still returns 502 when it does not.
- `t/node/upstream-tls2.t`: TEST 14-17 run the same scenario without
`proxy_ssl_verify on` in `http_config`. TEST 15 fails without this change.
- `t/node/upstream-tls2.t`, `t/node/upstream-mtls2.t`: the test harness does
not render `proxy_ssl_trusted_certificate` from `config.yaml`, so these files
now set `apisix.ssl.ssl_trusted_certificate` to the same CA as their
`proxy_ssl_trusted_certificate`, which is what a rendered `nginx.conf` always
has.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
