Skip to content

THREESCALE-11944 Verify CA certificate when sending request via proxy - #1573

Open
tkan145 wants to merge 3 commits into
3scale:masterfrom
tkan145:THREESCALE-11944
Open

THREESCALE-11944 Verify CA certificate when sending request via proxy#1573
tkan145 wants to merge 3 commits into
3scale:masterfrom
tkan145:THREESCALE-11944

Conversation

@tkan145

@tkan145 tkan145 commented Mar 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Fix https://redhat.atlassian.net/browse/THREESCALE-11944

Verification steps

  • Build new runtime-image
  • Get into dev-en
cd  dev-environments/https-proxy-upstream-tlsv1.3
  • Generate certs
make certs
  • Modify apicast-config.json as follow
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json b/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json
index 5227c5aa..78ec79d3 100644                                                                                                                   
--- a/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json                                                                           
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json                                                                           
@@ -15,6 +15,16 @@                                                                                                                                
             "name": "apicast.policy.http_proxy",                                                                                                 
             "configuration": {                                                                                                                   
               "https_proxy": "http://proxy:443/"                                                                                                 
+              }                                                                                                                                  
+          },                                                                                                                                     
+          {                                                                                                                                      
+            "name": "apicast.policy.upstream_mtls",                                                                                              
+            "configuration": {                                                                                                                   
+                "certificate": "/tmp/example.com.crt",                                                                                           
+                "certificate_type": "path",                                                                                                      
+                "certificate_key": "/tmp/example.com.key",                                                                                       
+                "certificate_key_type": "path",                                                                                                  
+                "verify": true                                                                                                                   
             }                                                                                                                                    
           },                                                                                                                                     
           {
  • Start the gateway
make gateway IMAGE_NAME=apicast-test
  • Send a request
curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123"

You should see 503

* Request completely sent off                                  
< HTTP/1.1 503 Service Temporarily Unavailable                 
< Date: Wed, 02 Sep 2026 06:35:57 GMT                          
< Content-Type: text/html                                      
< Content-Length: 162                                          
< Connection: keep-alive                                       
<                                                              
<html>                                                         
<head><title>503 Service Temporarily Unavailable</title></head>
<body>                                                         
<center><h1>503 Service Temporarily Unavailable</h1></center>  
</body>                                                        
</html>                                                        
* Connection #0 to host get.example.com:8080 left intact
  • Stop the gateway
CTRL-C
  • Modify docker-compose.yml as follow
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
index 25a49c52..21147317 100644                                                                                                                 
--- a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
@@ -16,6 +16,7 @@ services:                                                                                                                     
       APICAST_WORKERS: 1                                                                                                                       
       APICAST_LOG_LEVEL: debug                                                                                                                 
       APICAST_CONFIGURATION_CACHE: "0"                                                                                                         
+      SSL_CERT_FILE: "/etc/pki/rootCA.pem"
     expose:                                                                                                                                    
       - "8080"                                                                                                                                 
       - "8090"                                                                                                                                 
@@ -24,12 +25,13 @@ services:
       - "8090:8090"
     volumes:
       - ./apicast-config.json:/tmp/config.json
+      - ./cert/rootCA.pem:/etc/pki/rootCA.pem
   proxy:
     build:
       dockerfile: ./tinyproxy.Dockerfile
     expose:
-      - "3128:3128"
-      - "443:443"
+      - "3128"
+      - "443"
     volumes:
       - ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf                         
   example.com:
  • Start the gateway again and send a request, this time you should see 200

@tkan145
tkan145 requested a review from a team as a code owner March 18, 2026 04:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tkan145