Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: set default value of ssl_trusted_certificate to system #11993

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
+6 −5
Open

feat: set default value of ssl_trusted_certificate to system #11993

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
541ebd6
feat: use "system" as default when ssl_trusted_certificate not passed
Revolyssup Feb 25, 2025
3e8ba20
set in schema
Revolyssup Feb 25, 2025
04be7b3
update config example
Revolyssup Feb 25, 2025
58287b9
create combined file path if doesnt exist
Revolyssup Feb 25, 2025
b75a794
fix lint
Revolyssup Feb 25, 2025
b7c2140
lowercase
Revolyssup Feb 25, 2025
5877450
add ssl_trusted_combined in apisix.home
Revolyssup Feb 25, 2025
b4b8919
remove cli test
Revolyssup Feb 25, 2025
1bc7c63
modify test
Revolyssup Feb 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apisix/cli/ops.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -529,7 +529,7 @@ Please modify "admin_key" in conf/config.yaml .
end

local combined_cert_filepath = yaml_conf.apisix.ssl.ssl_trusted_combined_path
or "/usr/local/apisix/conf/ssl_trusted_combined.pem"
or profile.apisix_home .. "/conf/ssl_trusted_combined.pem"
util.gen_trusted_certs_combined_file(combined_cert_filepath, cert_paths)

yaml_conf.apisix.ssl.ssl_trusted_certificate = combined_cert_filepath
Expand Down
1 change: 1 addition & 0 deletions apisix/cli/schema.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ local config_schema = {
properties = {
ssl_trusted_certificate = {
type = "string",
default = "system",
},
ssl_trusted_combined_path = {
type = "string",
Expand Down
2 changes: 1 addition & 1 deletion conf/config.yaml.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ apisix:
# enable_http3: true
ssl_trusted_combined_path: /usr/local/apisix/conf/ssl_trusted_combined.pem # All the trusted certificates will be combined into a single file
#ssl_trusted_certificate: system # Specifies comma separated list of trusted CA. Value can be either "system"(for using system available ca certs) or
# a file path with trusted CA certificates in the PEM format
# a file path with trusted CA certificates in the PEM format. The default value is "system".
ssl_protocols: TLSv1.2 TLSv1.3 # TLS versions supported.
ssl_ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl_session_tickets: false # If true, session tickets are used for SSL/TLS connections.
Expand Down
6 changes: 3 additions & 3 deletions t/cli/test_deployment_data_plane.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,9 @@ deployment:

out=$(make run 2>&1 || true)
make stop
if ! echo "$out" | grep 'failed to load the configuration: https://127.0.0.1:12379: certificate verify failed'; then
echo "failed: should verify certificate by default"
if echo "$out" | grep 'failed to load the configuration: https://127.0.0.1:12379: certificate verify failed'; then
echo "failed: should verify certificate by default and not get certificate verify failed"
exit 1
fi

echo "passed: should verify certificate by default"
echo "passed: should verify certificate by default using system cert"
Loading