Skip to content

THREESCALE-11944 Verify CA certificate when sending request via proxy - #1573

Merged
tkan145 merged 3 commits into
3scale:masterfrom
tkan145:THREESCALE-11944
Sep 7, 2026
Merged

THREESCALE-11944 Verify CA certificate when sending request via proxy#1573
tkan145 merged 3 commits into
3scale:masterfrom
tkan145:THREESCALE-11944

Conversation

@tkan145

@tkan145 tkan145 commented Mar 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Fix https://redhat.atlassian.net/browse/THREESCALE-11944

Verification steps

  • Build new runtime-image
  • Get into dev-en
cd  dev-environments/https-proxy-upstream-tlsv1.3
  • Generate certs
make certs
  • Modify apicast-config.json as follow
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json b/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json
index 5227c5aa..78ec79d3 100644                                                                                                                   
--- a/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json                                                                           
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json                                                                           
@@ -15,6 +15,16 @@                                                                                                                                
             "name": "apicast.policy.http_proxy",                                                                                                 
             "configuration": {                                                                                                                   
               "https_proxy": "http://proxy:443/"                                                                                                 
+              }                                                                                                                                  
+          },                                                                                                                                     
+          {                                                                                                                                      
+            "name": "apicast.policy.upstream_mtls",                                                                                              
+            "configuration": {                                                                                                                   
+                "certificate": "/tmp/example.com.crt",                                                                                           
+                "certificate_type": "path",                                                                                                      
+                "certificate_key": "/tmp/example.com.key",                                                                                       
+                "certificate_key_type": "path",                                                                                                  
+                "verify": true                                                                                                                   
             }                                                                                                                                    
           },                                                                                                                                     
           {
  • Start the gateway
make gateway IMAGE_NAME=apicast-test
  • Send a request
curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123"

You should see 503

* Request completely sent off                                  
< HTTP/1.1 503 Service Temporarily Unavailable                 
< Date: Wed, 02 Sep 2026 06:35:57 GMT                          
< Content-Type: text/html                                      
< Content-Length: 162                                          
< Connection: keep-alive                                       
<                                                              
<html>                                                         
<head><title>503 Service Temporarily Unavailable</title></head>
<body>                                                         
<center><h1>503 Service Temporarily Unavailable</h1></center>  
</body>                                                        
</html>                                                        
* Connection #0 to host get.example.com:8080 left intact
  • Stop the gateway
CTRL-C
  • Modify docker-compose.yml as follow
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
index 25a49c52..21147317 100644                                                                                                                 
--- a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
@@ -16,6 +16,7 @@ services:                                                                                                                     
       APICAST_WORKERS: 1                                                                                                                       
       APICAST_LOG_LEVEL: debug                                                                                                                 
       APICAST_CONFIGURATION_CACHE: "0"                                                                                                         
+      SSL_CERT_FILE: "/etc/pki/rootCA.pem"
     expose:                                                                                                                                    
       - "8080"                                                                                                                                 
       - "8090"                                                                                                                                 
@@ -24,12 +25,13 @@ services:
       - "8090:8090"
     volumes:
       - ./apicast-config.json:/tmp/config.json
+      - ./cert/rootCA.pem:/etc/pki/rootCA.pem
   proxy:
     build:
       dockerfile: ./tinyproxy.Dockerfile
     expose:
-      - "3128:3128"
-      - "443:443"
+      - "3128"
+      - "443"
     volumes:
       - ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf                         
   example.com:
  • Start the gateway again and send a request, this time you should see 200

@tkan145
tkan145 requested a review from a team as a code owner March 18, 2026 04:08
@tkan145
tkan145 force-pushed the THREESCALE-11944 branch 3 times, most recently from 9612f9d to 2e674aa Compare September 2, 2026 05:14
@eguzki

eguzki commented Sep 7, 2026

Copy link
Copy Markdown
Member

needs rebase

@tkan145
tkan145 merged commit 088220c into 3scale:master Sep 7, 2026
12 checks passed
@tkan145
tkan145 deleted the THREESCALE-11944 branch September 7, 2026 22:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eguzki eguzki eguzki approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tkan145 @eguzki