Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clarification on mTLS verification with curl #925

Merged
merged 4 commits into from
Feb 3, 2018
+7 −2
Merged

clarification on mTLS verification with curl #925

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bdccdb6
clarification on mTLS verification with curl
ldemailly Feb 2, 2018
853de10
Merge branch 'master' into ldemailly-patch-2
ldemailly Feb 2, 2018
d56cfaf
update ptal
ldemailly Feb 2, 2018
fe1c146
Merge branch 'master' into ldemailly-patch-2
ldemailly Feb 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions _docs/tasks/security/mutual-tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@ There are several steps:
```
```bash
...
* error fetching CN from cert:The requested data were not available.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this to show the expected error

...
< HTTP/1.1 200 OK
< content-type: text/html; charset=utf-8
< content-length: 1867
Expand All @@ -111,11 +113,14 @@ Note that Istio uses [Kubernetes service account](https://kubernetes.io/docs/tas
as service identity, which offers stronger security than service name
(refer [here]({{home}}/docs/concepts/security/mutual-tls.html#identity) for more information).
Thus the certificates used in Istio do not have service name, which is the information that curl needs to verify
server identity. As a result, we use curl option '-k' to prevent the curl client from verifying service identity
in server's (i.e., productpage) certificate.
server identity. As a result, we use curl option '-k' to prevent the curl client from aborting when failing to
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wattli I rephrased a bit - what do you think ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks for fixing this up

find and verify the server name (i.e., productpage.ns.svc.cluster.local) in the certificate provided by the server.

Please check secure naming [here]({{home}}/docs/concepts/security/mutual-tls.html#workflow) for more information
about how the client verifies the server's identity in Istio.

What we are demonstrating and verifying above is that the server accepts the connection from the client. Try not giving the client `--key` and `--cert` and observe you are not allowed to connect and you do not get an HTTP 200.

## Further reading

* Learn more about the design principles behind Istio's automatic mTLS authentication
Expand Down