Archives/smallstep-certificates
2
0
Fork 0
mirror of https://github.com/smallstep/certificates.git synced 2024-11-11 07:11:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
ea23f738cb
smallstep-certificates/autocert/examples/hello-mtls
History
Mariano Cano 2e98febcd9 Add envoy hello mTLS example. 
Fixes smallstep/ca-component#144
2019-02-07 15:30:37 -08:00
..
curl hello-mtls examples 2019-01-24 17:22:36 -08:00
envoy Add envoy hello mTLS example. 2019-02-07 15:30:37 -08:00
go hello-mtls examples 2019-01-24 17:22:36 -08:00
nginx Remove unnecessary sleep. 2019-02-07 12:05:38 -08:00
node Add client implementation of hello-mTLS using nodejs 2019-02-06 16:42:29 -08:00
README.md Add envoy hello mTLS example. 2019-02-07 15:30:37 -08:00

README.md

hello-mtls

This repository contains examples of dockerized [m]TLS clients and servers in various languages. There's a lot of confusion and misinformation regarding how to do mTLS properly with an internal public key infrastructure. The goal of this repository is to demonstrate best practices like:

  • Properly configuring TLS to use your internal CA's root certificate
  • mTLS (client certificates / client authentication)
  • Short-lived certificate support (clients and servers automatically load renewed certificates)

Examples use multi-stage docker builds and can be built via without any required local dependencies (except docker):

docker build -f Dockerfile.server -t hello-mtls-server-<lang> .
docker build -f Dockerfile.client -t hello-mtls-client-<lang> .

Once built, you should be able to deploy via:

kubectl apply -f hello-mtls.server.yaml
kubectl apply -f hello-mtls.client.yaml

Feature matrix

This matrix shows the set of features we'd like to demonstrate in each language and where each language is. Bug fixes, improvements, and examples in new languages are appreciated!

go/

  • Server using autocert certificate & key
    • mTLS (client authentication using internal root certificate)
    • Automatic certificate renewal
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation
  • Client using autocert root certificate
    • mTLS (send client certificate if server asks for it)
    • Automatic certificate rotation
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation

curl/

  • Client
    • mTLS (send client certificate if server asks for it)
    • Automatic certificate rotation
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation

nginx/

  • Server
    • mTLS (client authentication using internal root certificate)
    • Automatic certificate renewal
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation

node/

  • Server
    • mTLS (client authentication using internal root certificate)
    • Automatic certificate renewal
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation
  • Client using autocert root certificate
    • mTLS (send client certificate if server asks for it)
    • Automatic certificate rotation
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation

envoy/

  • Server
    • mTLS (client authentication using internal root certificate)
    • Automatic certificate renewal
    • Restrict to safe ciphersuites and TLS versions
    • TLS stack configuration loaded from step-ca
    • Root certificate rotation