Skip to content

Add CRL support to architecture overview #437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattklein123 merged 2 commits into from
Jan 26, 2018
Merged

Add CRL support to architecture overview #437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a748ed
Add CRL docs to architecture overview
adunham-stripe Jan 26, 2018
2dacee8
Change 'file' to 'DataSource' in CRL field documentation
adunham-stripe Jan 26, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/root/intro/arch_overview/ssl.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ requirements (TLS1.2, SNI, etc.). Envoy supports the following TLS features:
to server certificate verification.
* **Certificate verification and pinning**: Certificate verification options include basic chain
verification, subject name verification, and hash pinning.
* **Certificate revocation**: Envoy can check peer certificates against a certificate revocation list
(CRL) if one is :ref:`provided <envoy_api_field_auth.CertificateValidationContext.crl>`.
* **ALPN**: TLS listeners support ALPN. The HTTP connection manager uses this information (in
addition to protocol inference) to determine whether a client is speaking HTTP/1.1 or HTTP/2.
* **SNI**: SNI is currently supported for client connections. Listener support is likely to be added
Expand Down
2 changes: 1 addition & 1 deletion envoy/api/v2/auth/cert.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ message CertificateValidationContext {
// An optional `certificate revocation list
// <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
// (in PEM format). If specified, Envoy will verify that the presented peer
// certificate has not been revoked by this CRL. If this file contains
// certificate has not been revoked by this CRL. If this DataSource contains
// multiple CRLs, all of them will be used.
DataSource crl = 7;
}
Expand Down