3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-06 04:42:56 +02:00
Code Issues Projects Releases Packages Wiki Activity

policy: add new certificate-authority option for downstream mTLS client certificates (#1835)

Browse source 
* policy: add new certificate-authority option for downstream mTLS client certificates

* update proto, docs
This commit is contained in:
Caleb Doxsey 2021-02-01 08:10:32 -07:00 • committed by GitHub
parent 8e3404e7be
commit cc85ea601d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 490 additions and 406 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/reference/readme.md
View file

@ -1333,6 +1333,15 @@ TLS Custom Certificate Authority defines a set of root certificate authorities t
Note: This setting will replace (not append) the system's trust store for a given route.
### TLS Downstream Client Certificate Authority
- Config File Key: `tls_downstream_client_ca` or `tls_downstream_client_ca_file`
- Type: [base64 encoded] `string` or relative file location
- Optional
If specified downstream clients (eg a user's browser) will be required to provide a valid client TLS
certificate. This overrides the global `client_ca` option for this route.
### TLS Client Certificate
- Config File Key: `tls_client_cert` and `tls_client_key` or `tls_client_cert_file` and `tls_client_key_file`
- Type: [base64 encoded] `string` or relative file location

9
docs/reference/settings.yaml
View file

@ -1460,6 +1460,15 @@ settings:
TLS Custom Certificate Authority defines a set of root certificate authorities that clients use when verifying server certificates.
Note: This setting will replace (not append) the system's trust store for a given route.
- name: "TLS Downstream Client Certificate Authority"
keys: ["tls_downstream_client_ca", "tls_downstream_client_ca_file"]
attributes: |
- Config File Key: `tls_downstream_client_ca` or `tls_downstream_client_ca_file`
- Type: [base64 encoded] `string` or relative file location
- Optional
doc: |
If specified downstream clients (eg a user's browser) will be required to provide a valid client TLS
certificate. This overrides the global `client_ca` option for this route.
- name: "TLS Client Certificate"
keys:
[