title: Configuring envoy to skip mTLS on a specific http route
body: <p>I am using envoy has an edge proxy.
  Basically I want mTLS downstream on all http paths except for one.
  I have the following config:
  Notice how I set <code>require_client_certificate: false</code> in the first route</p>
  <pre><code>admin:
    access_log_path: /dev/stdout
    address:
      socket_address:
        address: 127.0.0.1
        port_value: 9901
  static_resources:
    listeners:
    - name: listener_0
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 443
      filter_chains:
      - filters:
        - name: envoy.filters.network.http_connection_manager
          typed_config:
            &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
            stat_prefix: ingress_http
            codec_type: AUTO
            route_config:
              name: local_route
              virtual_hosts:
              - name: local_service
                domains: [&quot;*&quot;]
                routes:
                - match:
                    prefix: &quot;/s1/request/get&quot;
                    headers:
                    - name: &quot;:method&quot;
                      exact_match: &quot;GET&quot;
                  route:
                    host_rewrite_literal: service1
                    cluster: internal_service1
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            &quot;@type&quot;: type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            require_client_certificate: false
            common_tls_context:
              tls_certificates:
                certificate_chain: 
                  filename: /etc/ssl/listener/cert.pem
                private_key: 
                  filename: /etc/ssl/listener/key.pem
              validation_context:
                trusted_ca:
                  filename: /etc/ssl/cluster/cabundle.pem
      - filters:
        - name: envoy.filters.network.http_connection_manager
          typed_config:
            &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
            stat_prefix: ingress_http
            codec_type: AUTO
            route_config:
              name: local_route
              virtual_hosts:
              - name: local_service
                domains: [&quot;*&quot;]
                routes:
                - match:
                    prefix: &quot;/s1/request/post&quot;
                    headers:
                    - name: &quot;:method&quot;
                      exact_match: &quot;POST&quot;
                  route:
                    host_rewrite_literal: service1
                    cluster: internal_service1
                   
            http_filters:
            - name: envoy.filters.http.router
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            &quot;@type&quot;: type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            require_client_certificate: true
            common_tls_context:
              tls_certificates:
                certificate_chain: 
                  filename: /etc/ssl/listener/cert.pem
                private_key: 
                  filename: /etc/ssl/listener/key.pem
              validation_context:
                trusted_ca:
                  filename: /etc/ssl/cluster/cabundle.pem
  
    clusters:
    - name: internal_service1
      connect_timeout: 0.25s
      type: LOGICAL_DNS
      # Comment out the following line to test on v6 networks
      dns_lookup_family: V4_ONLY
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: internal_service1
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: service1
                  port_value: 443
      tls_context:
        allow_renegotiation: true
        common_tls_context:
          tls_certificates:
            certificate_chain: 
              filename: /etc/ssl/listener/cert.pem
            private_key: 
              filename: /etc/ssl/listener/key.pem
          validation_context:
            trusted_ca:
              filename: /etc/ssl/cluster/cabundle.pem
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          &quot;@type&quot;: type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          sni: service1
  </code></pre>
  <p>So, when I do a</p>
  <pre><code>curl -k  --location  --cacert cabundle.pem --request GET 'http://localhost:443/s1/request/get'
  </code></pre>
  <p>I expect the request to go through and get a 200 response</p>
  <p>Whereas, I if I hit <code>/s1/request/post</code>, then I expect mTLS to take place so I should be providing a certificate and a key.</p>
  <p>However, when I start the envoy, I get the following error</p>
  <pre><code>[2020-10-28 05:42:40.674][1][debug][init] [source/common/init/watcher_impl.cc:27] init manager Server destroyed
  error adding listener '0.0.0.0:443': multiple filter chains with the same matching rules are defined
  make: *** [run-local] Error 1
  </code></pre>
  <p>Is this the correct way to do the stuff I want?</p>