AlinsRan commented on code in PR #14113:
URL: https://github.com/apache/apisix/pull/14113#discussion_r4398936405
##########
apisix/upstream.lua:
##########
@@ -107,13 +136,19 @@ local function set_upstream_ssl_opts(up_conf)
end
end
+ local store, err
if tls.ca_certs then
- local store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
- create_trusted_store,
tls.ca_certs)
- if not store then
- return nil, err
- end
+ store, err = trusted_store_cache(tls.ca_certs,
up_conf.resource_version,
+ create_trusted_store, tls.ca_certs)
+ elseif tls.verify then
+ store = default_trusted_store
Review Comment:
Thanks, confirmed and reworked. The Lua `default_trusted_store` is gone:
without `tls.ca_certs`, the verify store is never replaced. Explicit `ca_certs`
keeps its current behaviour.
The root cause is now fixed in the runtime. api7/apisix-nginx-module#137
loads `proxy_ssl_trusted_certificate` / `grpc_ssl_trusted_certificate`, the
verify depth and `*_ssl_crl` into nginx's own upstream `SSL_CTX` store without
requiring a static `*_ssl_verify on`. Loading them does not enable
verification. Per-request `tls.verify` therefore verifies against nginx's
store, CRL and CRL check flags included.
The regression is in `t/node/upstream-tls-trusted-ca.t`. It covers https and
grpcs, static verify on and off, and certificates that are trusted, revoked, or
from an untrusted CA. Your case (`proxy_ssl_verify on` + `proxy_ssl_crl` +
`tls.verify: true` without `ca_certs`) returns 200 for the valid certificate
and 502 `(23:certificate revoked)` for the revoked one. The PR is in draft
until a runtime release includes that change. `APISIX_RUNTIME` is a placeholder
until then.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
