fix: Support secrets for client ca#13061
fix: Support secrets for client ca#13061cybersec-jochenarnold wants to merge 1 commit intoapache:masterfrom
Conversation
dosubot
bot
added
size:L
There was a problem hiding this comment.
I think you can move the test case to client-mtls.t https://github.com/apache/apisix/blob/16b9d7e5b611a729c6eb99d3fbca6c8bce71f494/t/node/client-mtls.t, since the test cases involve mTLS (client side verification)
There was a problem hiding this comment.
Pull request overview
This PR adds support for secret references (e.g., $env:// or $secret:// for Vault) in the client.ca field of the SSL configuration, allowing CA certificates for mTLS client verification to be fetched from secret managers like HashiCorp Vault or environment variables. This is consistent with how cert, key, certs, and keys fields already support secret URIs.
Changes:
- Schema updated to allow
client.cato accept either a PEM certificate string or a secret URI (consistent with other SSL fields). - SSL validation logic updated to skip PEM validation when
client.cais a secret URI. - SSL router updated to read
client.caandclient.depthfrom the secrets-resolved copy (new_ssl_value) rather thanmatched_ssl.value.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
apisix/schema_def.lua |
Updates client.ca schema to use oneOf allowing a certificate string or a secret URI, matching the pattern used for cert, key, certs, and keys. |
apisix/ssl.lua |
Skips PEM validation for client.ca when it is a secret URI, consistent with how cert/key validation is skipped. |
apisix/ssl/router/radixtree_sni.lua |
Reads client.ca and client.depth from new_ssl_value (the secrets-resolved copy) instead of from the raw matched_ssl.value. |
docs/en/latest/terminology/secret.md |
Adds mention of CA certificates and public certificates alongside private keys in the description of cryptographic material that can be stored as secrets. |
t/node/ssl.t |
Adds TEST 8–11 covering vault and env secret support for client.ca; also stores the CA cert in vault as part of TEST 1. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| key = "$secret://vault/test/ssl/test.com.key", | ||
| cert = "$secret://vault/test/ssl/test.com.crt", | ||
| client = { | ||
| ca = "$secret://vault/test/ssl/test.com.3.client-ca.key" |
There was a problem hiding this comment.
In TEST 8, the request data for the client CA uses the wrong vault key name: "$secret://vault/test/ssl/test.com.3.client-ca.key". The vault secret was stored in TEST 1 as test.com.3.client-ca.crt, so the correct URI should be "$secret://vault/test/ssl/test.com.3.client-ca.crt". Using the .key suffix will cause the vault lookup to fail at runtime in TEST 9 since the key does not exist in vault.
The expected response body in the t.test call (line 273) correctly shows .crt, but the input data (line 260) sends .key, causing a mismatch between what is stored and what the test expects to see in the response.
| ca = "$secret://vault/test/ssl/test.com.3.client-ca.key" | |
| ca = "$secret://vault/test/ssl/test.com.3.client-ca.crt" |
| fetching data from env uri | ||
| fetching data from env uri | ||
| fetching data from env uri | ||
| fetching data from env uri |
There was a problem hiding this comment.
TEST 9 uses vault-based SSL configuration (cert, key, and client CA are all $secret://vault/... URIs from TEST 8), but the --- error_log section expects fetching data from env uri (which is the log message emitted when fetching $env:// URIs). Since the configuration uses vault secret URIs, the actual log message would be fetching data from secret uri (emitted by fetch_by_uri_secret in apisix/secret.lua). This mismatch will cause the test to fail. Compare with TEST 5, which also uses vault secrets and correctly expects fetching data from secret uri.
| fetching data from env uri | |
| fetching data from env uri | |
| fetching data from env uri | |
| fetching data from env uri | |
| fetching data from secret uri | |
| fetching data from secret uri | |
| fetching data from secret uri | |
| fetching data from secret uri |
Description
Allow secrets like env or secret for client ca in ssl config.
Useful to fetch ca cert directly from e.g. Vault.
Which issue(s) this PR fixes:
Fixes #13021
Checklist