membphis commented on code in PR #14113:
URL: https://github.com/apache/apisix/pull/14113#discussion_r4398484096
##########
apisix/upstream.lua:
##########
@@ -107,13 +136,19 @@ local function set_upstream_ssl_opts(up_conf)
end
end
+ local store, err
if tls.ca_certs then
- local store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
- create_trusted_store,
tls.ca_certs)
- if not store then
- return nil, err
- end
+ store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
+ create_trusted_store, tls.ca_certs)
+ elseif tls.verify then
+ store = default_trusted_store
Review Comment:
[P1] Preserve configured CRL checks when applying default CAs
When `proxy_ssl_verify on` and `proxy_ssl_crl` are configured, an upstream
with `tls.verify: true` and no `tls.ca_certs` previously used NGINX's CA+CRL
store. This branch now replaces it with `default_trusted_store`, which is
created using only `store:load_file(path)`. The CRL entries and
`X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL` flags are lost, so a
certificate signed by a trusted CA but already revoked can pass verification.
NGINX loads the CRL and its flags into the original store in
[ngx_ssl_crl](https://github.com/nginx/nginx/blob/release-1.27.1/src/event/ngx_event_openssl.c#L919-L958).
The runtime applies the replacement using
[SSL_set1_verify_cert_store](https://github.com/api7/apisix-nginx-module/blob/main/src/ngx_http_apisix_module.c#L341-L353),
rather than merging it with the existing store.
An isolated in-memory TLS handshake experiment with OpenSSL 3.6.3 confirmed
the mechanism for the same revoked certificate:
```text
NGINX-style CA+CRL store: verify_result=23 (certificate revoked)
CA-only replacement store: verify_result=0 (ok)
```
This was a standalone OpenSSL experiment, not a full gateway reproduction.
Please load the default CAs into the existing SSL_CTX store, or otherwise
preserve its CRLs and verification flags when applying the fallback. Add a
real-gateway regression with `proxy_ssl_verify on`, `proxy_ssl_crl`, and
upstream `tls.verify: true` without `ca_certs`, asserting that a valid
certificate returns 200 and a revoked certificate still returns 502.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
