U jeediso macluulka TLS ee sare ee Envoy ee xidhmada CA ee ku jira weelka

TLS ay bilowdo kooxda forward-proxy firfircoon, ku habee trusted_ca kooxdaas adigoo ilaalinaya xaqiijinta SAN ee meesha loo socdo.

transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    common_tls_context:
      validation_context:
        trusted_ca:
          filename: /etc/envoy/trust/upstream-ca.pem

Tan ku dar qaabeynta kooxda forward-proxy firfircoon. Waddada xidhmada la ansixiyay waa in ay akhrisan karaan habka Envoy ee socda. Kubernetes, baadh faylka lagu dhejiyay weelka gudihiisa; shahaado lagu rakibay oo kaliya qanjidhka shaqada ma bixiso taas.

Ku dar CA loo baahan yahay iyada oo loo marayo habka agabka kalsoonida ee daabacaadda, oo xaqiiji in meesha loo socdo ay bixiso shahaadooyinka dhexe ee loo baahan yahay. Codsiyada ku dhaqan habka qaabeynta ama cusboonaysiinta sirta ee la doortay.

Habaynta TLS forward-proxy firfircoon ee la diiwaangeliyay waxay bixisaa SNI iyo xaqiijinta SAN ee magaca martigeliyaha ee martigeliyaha la xalliyay. Haynta hubinta aqoonsigaas la socoto xaqiijinta silsiladda.

Codsi wget oo guulaystay wuxuu isticmaali karaa ilo kalsooni kale. Gelintan waxay daboolaysaa TLS ka soo jeeda Envoy; gudbinta CONNECT caadiga ah, barnaamijku wuxuu ahaanayaa macmiilka TLS ee xaqiijiya meesha loo socdo.

Maqaallo la xiriira