{"action":"opened","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/2675","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2675/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2675/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2675/events","html_url":"https://github.com/envoyproxy/envoy/issues/2675","id":300282742,"number":2675,"title":"question: tcp proxy intermediate certs","user":{"login":"marcosrmendezthd","id":13423168,"avatar_url":"https://avatars1.githubusercontent.com/u/13423168?v=4","gravatar_id":"","url":"https://api.github.com/users/marcosrmendezthd","html_url":"https://github.com/marcosrmendezthd","followers_url":"https://api.github.com/users/marcosrmendezthd/followers","following_url":"https://api.github.com/users/marcosrmendezthd/following{/other_user}","gists_url":"https://api.github.com/users/marcosrmendezthd/gists{/gist_id}","starred_url":"https://api.github.com/users/marcosrmendezthd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcosrmendezthd/subscriptions","organizations_url":"https://api.github.com/users/marcosrmendezthd/orgs","repos_url":"https://api.github.com/users/marcosrmendezthd/repos","events_url":"https://api.github.com/users/marcosrmendezthd/events{/privacy}","received_events_url":"https://api.github.com/users/marcosrmendezthd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-26T15:31:08Z","updated_at":"2018-02-26T15:31:08Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"**Issue Template**\r\n\r\n*Title*: *question: tcp proxy intermediate certs*\r\n\r\n*Description*:\r\n>I'm using envoy to proxy to another endpoint that has a self-signed cert. This is similar to your integration test example that uses an upstream cert/ca. The issue I'm having is that I'm not sure if envoy is sending the intermediate certs or perhaps I'm doing something wrong. The upstream cert not self-signed.\r\n\r\nWhen I connect to the first port in the configuration below (10000) I get the backend service's self-signed cert as expected. When I connect to the second port (10065) I get the upstream cert as expected, but it can't be validated. I'm able to validate the cert file using the CA I'm using on envoy via openssl, but not via a connection if that makes sense.\r\n\r\n```openssl s_client -showcerts -connect localhost:10065CONNECTED(00000005)\r\ndepth=0 C = **, ST = **, L = ***, O = ***, CN = ***\r\nverify error:num=20:unable to get local issuer certificate\r\nverify return:1\r\ndepth=0 C = **, ST = **, L = **, O = ***, CN = ***\r\nverify error:num=27:certificate not trusted\r\nverify return:1\r\ndepth=0 C = **, ST = **, L = **, O = ***, CN = ***\r\nverify error:num=21:unable to verify the first certificate\r\nverify return:1\r\n---\r\nCertificate chain\r\n 0 s:/C=**/ST=**/L=**/O=****/CN=****\r\n   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K\r\n```\r\n\r\nNote that not all certificates in the CA are listed for some reason ^^^^^.\r\n\r\nExample configuration below:\r\n\r\n```{\r\n  \"listeners\": [\r\n    {\r\n      \"address\": \"tcp://0.0.0.0:10000\",\r\n      \"filters\": [\r\n        {\r\n          \"name\": \"tcp_proxy\",\r\n          \"type\": \"read\",\r\n          \"config\": {\r\n            \"stat_prefix\": \"simple.\",\r\n            \"route_config\": {\r\n              \"routes\": [\r\n                {\r\n                  \"cluster\": \"simple\"\r\n                }\r\n              ]\r\n            }\r\n          }\r\n        }\r\n      ]\r\n    },\r\n    {\r\n      \"address\": \"tcp://0.0.0.0:10065\",\r\n      \"ssl_context\": {\r\n        \"ca_cert_file\": \"/UPSTREAM_CA.crt\",\r\n        \"cert_chain_file\": \"/UPSTREAM_CRT.crt\",\r\n        \"private_key_file\": \"/UPSTREAM_KEY.key\"\r\n      },\r\n      \"filters\": [\r\n        {\r\n          \"type\": \"read\",\r\n          \"name\": \"tcp_proxy\",\r\n          \"config\": {\r\n            \"stat_prefix\": \"ssl.\",\r\n            \"route_config\": {\r\n              \"routes\": [\r\n                {\r\n                  \"cluster\": \"ssl\"\r\n                }\r\n              ]\r\n            }\r\n          }\r\n        }\r\n      ]\r\n    }\r\n  ],\r\n  \"admin\": {\r\n    \"access_log_path\": \"/dev/null\",\r\n    \"address\": \"tcp://0.0.0.0:8001\"\r\n  },\r\n  \"cluster_manager\": {\r\n    \"clusters\": [\r\n      {\r\n        \"name\": \"simple\",\r\n        \"connect_timeout_ms\": 5000,\r\n        \"type\": \"static\",\r\n        \"lb_type\": \"round_robin\",\r\n        \"hosts\": [\r\n          {\r\n            \"url\": \"tcp://someip:port\"\r\n          }\r\n        ]\r\n      },\r\n      {\r\n        \"name\": \"ssl\",\r\n        \"connect_timeout_ms\": 5000,\r\n        \"type\": \"static\",\r\n        \"lb_type\": \"round_robin\",\r\n        \"hosts\": [\r\n          {\r\n            \"url\": \"tcp://someip:port\"\r\n          }\r\n        ],\r\n        \"ssl_context\": {\r\n          \"cert_chain_file\": \"/SELF_SIGNED.crt\",\r\n          \"private_key_file\": \"/SELF_SIGNED.key\"\r\n        }\r\n      }\r\n    ]\r\n  }\r\n}\r\n```\r\n\r\n[optional *Relevant Links*:]\r\n>Any extra documentation required to understand the issue.\r\n\r\n\r\n\r\n**Bug Template**\r\n\r\n*Title*: *One line description*\r\n\r\n*Description*:\r\n>What issue is being seen? Describe what should be happening instead of\r\nthe bug, for example: Envoy should not crash, the expected value isn't\r\nreturned, etc.\r\n\r\n*Repro steps*:\r\n> Include sample requests, environment, etc. All data and inputs\r\nrequired to reproduce the bug.\r\n\r\n>**Note**: The [Envoy_collect tool](https://github.com/envoyproxy/envoy/blob/master/tools/envoy_collect/README.md)\r\ngathers a tarball with debug logs, config and the following admin\r\nendpoints: /stats, /clusters and /server_info. Please note if there are\r\nprivacy concerns, sanitize the data prior to sharing the tarball/pasting.\r\n\r\n*Admin and Stats Output*:\r\n>Include the admin output for the following endpoints: /stats,\r\n/clusters, /routes, /server_info. For more information, refer to the\r\n[admin endpoint documentation.](https://www.envoyproxy.io/docs/envoy/latest/operations/admin)\r\n\r\n>**Note**: If there are privacy concerns, sanitize the data prior to\r\nsharing.\r\n\r\n*Config*:\r\n>Include the config used to configure Envoy.\r\n\r\n*Logs*:\r\n>Include the access logs and the Envoy logs.\r\n\r\n>**Note**: If there are privacy concerns, sanitize the data prior to\r\nsharing.\r\n\r\n*Call Stack*:\r\n> If the Envoy binary is crashing, a call stack is **required**.\r\nPlease refer to the [Bazel Stack trace documentation](https://github.com/envoyproxy/envoy/tree/master/bazel#stack-trace-symbol-resolution).\r\n"}}
{"actor":{"display_login":"marcosrmendezthd"}}