maskit opened a new pull request, #13548: URL: https://github.com/apache/trafficserver/pull/13548
## Summary Layered-cache deployments have TLS connections between nodes under the same operator's control, where the CA/hostname-verification machinery that X.509 exists for isn't needed -- a raw public key, pinned per hop, is sufficient. RPK is negotiated alongside X.509 rather than replacing it, so a hop between nodes at different points in a rolling upgrade falls back to a normal certificate exchange rather than failing. Adds build-time detection of OpenSSL 3.2+'s `SSL_CTX_set1_server_cert_type` and BoringSSL's `SSL_CREDENTIAL_new_raw_public_key`, and a library-agnostic `SSLRPKUtils` helper for loading and pinning trusted keys. New settings: - `ssl_multicert.yaml`: `ssl_rpk_enabled`, `ssl_client_rpk_ca_name` - `sni.yaml`: `client_rpk_enabled`, `server_rpk_ca` On BoringSSL, accepting an RPK client cert requires switching to `SSL_CTX_set_custom_verify`, which disables automatic X.509 chain verification for the whole connection, so the X.509 fallback path is reimplemented manually there on both client and server sides. ## Test plan - [x] New unit tests (`test_SSLRPKUtils.cc`, `test_YamlSNIConfig.cc`) covering key loading/pinning and sni.yaml parsing - [x] New autest (`tls_rpk_hop.test.py`) covering RPK negotiation, X.509 fallback during a rolling upgrade, pin mismatch under ENFORCED/PERMISSIVE, and mTLS pinning via `ssl_client_rpk_ca_name` - [x] Verified on both OpenSSL 3.2+ and BoringSSL builds -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
