Skip to content

Commit 7b5cf87

Browse files
phlaxphlax
authored
examples: Add TLS SNI sandbox (envoyproxy#13975)
Signed-off-by: Ryan Northey <[email protected]>
1 parent d830384 commit 7b5cf87

19 files changed

+657
-1
lines changed

‎ci/verify_examples.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ trap exit 1 INT
2929
run_examples () {
3030
local examples example
3131
cd "${SRCDIR}/examples" || exit 1
32-
examples=$(find . -mindepth 1 -maxdepth 1 -type d -name "$TESTFILTER" | sort)
32+
examples=$(find . -mindepth 1 -maxdepth 1 -type d -name "$TESTFILTER" ! -iname "_*" | sort)
3333
for example in $examples; do
3434
pushd "$example" > /dev/null || return 1
3535
./verify.sh

‎docs/root/start/sandboxes/index.rst

+1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ The following sandboxes are available:
6363
postgres
6464
redis
6565
skywalking_tracing
66+
tls-sni
6667
tls
6768
wasm-cc
6869
websocket

‎docs/root/start/sandboxes/tls-sni.rst

+175
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
.. _install_sandboxes_tls_sni:
2+
3+
TLS Server name indication (``SNI``)
4+
====================================
5+
6+
.. sidebar:: Requirements
7+
8+
.. include:: _include/docker-env-setup-link.rst
9+
10+
:ref:`curl <start_sandboxes_setup_curl>`
11+
Used to make ``HTTP`` requests.
12+
13+
:ref:`jq <start_sandboxes_setup_jq>`
14+
Parse ``json`` output from the upstream echo servers.
15+
16+
This example demonstrates an Envoy proxy that listens on three ``TLS`` domains
17+
on the same ``IP`` address.
18+
19+
The first two domains (``domain1`` and ``domain2``) terminate the ``TLS`` and proxy
20+
to upstream ``HTTP`` hosts.
21+
22+
The other domain (``domain3``) is proxied unterminated, based on the ``SNI`` headers.
23+
24+
It also demonstrates Envoy acting as a client proxy connecting to upstream ``SNI`` services.
25+
26+
.. _install_sandboxes_tls_sni_step1:
27+
28+
Step 1: Create keypairs for each of the domain endpoints
29+
********************************************************
30+
31+
Change directory to ``examples/tls-sni`` in the Envoy repository.
32+
33+
The example creates two Envoy ``TLS`` endpoints and they will require their own
34+
keypairs.
35+
36+
Create self-signed certificates for these endpoints as follows:
37+
38+
.. code-block:: console
39+
40+
$ pwd
41+
envoy/examples/tls-sni
42+
43+
$ mkdir -p certs
44+
45+
$ openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
46+
-subj "/C=US/ST=CA/O=MyExample, Inc./CN=domain1.example.com" \
47+
-keyout certs/domain1.key.pem \
48+
-out certs/domain1.crt.pem
49+
Generating a RSA private key
50+
.............+++++
51+
...................+++++
52+
writing new private key to 'certs/domain1.key.pem'
53+
-----
54+
55+
$ openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
56+
-subj "/C=US/ST=CA/O=MyExample, Inc./CN=domain2.example.com" \
57+
-keyout certs/domain2.key.pem \
58+
-out certs/domain2.crt.pem
59+
Generating a RSA private key
60+
.............+++++
61+
...................+++++
62+
writing new private key to 'certs/domain2.key.pem'
63+
-----
64+
65+
.. warning::
66+
67+
``SNI`` does *not* validate that the certificates presented are correct for the domain, or that they
68+
were issued by a recognised certificate authority.
69+
70+
See the :ref:`Securing Envoy quick start guide <start_quick_start_securing>` for more information about
71+
:ref:`validating cerfificates <start_quick_start_securing_validation>`.
72+
73+
.. _install_sandboxes_tls_sni_step2:
74+
75+
Step 2: Start the containers
76+
****************************
77+
78+
Build and start the containers.
79+
80+
This starts two upstream ``HTTP`` containers listening on the internal Docker network on port ``80``, and
81+
an upstream ``HTTPS`` service listening on internal port ``443``
82+
83+
In front of these is an Envoy proxy that listens on https://localhost:10000 and serves three ``SNI`` routed
84+
``TLS`` domains:
85+
86+
- ``domain1.example.com``
87+
- ``domain2.example.com``
88+
- ``domain3.example.com``
89+
90+
The first two domains use the keys and certificates :ref:`you created in step 1 <install_sandboxes_tls_sni_step1>` to terminate ``TLS`` and
91+
proxy to the two upstream ``HTTP`` servers.
92+
93+
The third domain proxies to the upstream ``TLS`` server based on the requested ``SNI`` address, but does no ``TLS`` termination itself.
94+
95+
The composition also starts an Envoy proxy client which listens on http://localhost:20000.
96+
97+
The client proxy has no ``TLS`` termination but instead proxies three routed paths -
98+
``/domain1``, ``/domain2`` and ``/domain3`` - to the ``SNI``-enabled proxy.
99+
100+
.. code-block:: console
101+
102+
$ pwd
103+
envoy/examples/tls-sni
104+
$ docker-compose build --pull
105+
$ docker-compose up -d
106+
$ docker-compose ps
107+
108+
Name Command State Ports
109+
-------------------------------------------------------------------------------------------
110+
tls-sni_http-upstream1_1 node ./index.js Up
111+
tls-sni_http-upstream2_1 node ./index.js Up
112+
tls-sni_http-upstream3_1 node ./index.js Up
113+
tls-sni_proxy_1 /docker-entrypoint.sh /usr ... Up 0.0.0.0:10000->10000/tcp
114+
tls-sni_proxy-client_1 /docker-entrypoint.sh /usr ... Up 0.0.0.0:20000->10000/tcp
115+
116+
Step 2: Query the ``SNI`` endpoints directly with curl
117+
******************************************************
118+
119+
You can use curl to query the ``SNI``-routed ``HTTPS`` endpoints of the Envoy proxy directly.
120+
121+
To do this you must explicitly tell curl to resolve the ``DNS`` for the endpoints correctly.
122+
123+
Each endpoint should proxy to the respective ``http-upstream`` or ``https-upstream`` service.
124+
125+
.. code-block:: console
126+
127+
$ curl -sk --resolve domain1.example.com:10000:127.0.0.1 \
128+
https://domain1.example.com:10000 \
129+
| jq -r '.os.hostname'
130+
http-upstream1
131+
132+
$ curl -sk --resolve domain2.example.com:10000:127.0.0.1 \
133+
https://domain2.example.com:10000 \
134+
| jq -r '.os.hostname'
135+
http-upstream2
136+
137+
$ curl -sk --resolve domain3.example.com:10000:127.0.0.1 \
138+
https://domain3.example.com:10000 \
139+
| jq -r '.os.hostname'
140+
https-upstream3
141+
142+
Step 3: Query the ``SNI`` endpoints via an Envoy proxy client
143+
*************************************************************
144+
145+
Next, query the Envoy proxy client using the routed paths.
146+
147+
These route via the ``SNI`` proxy endpoints to the respective ``http-upstream`` or
148+
``https-upstream`` services.
149+
150+
.. code-block:: console
151+
152+
$ curl -s http://localhost:20000/domain1 \
153+
| jq '.os.hostname'
154+
http-upstream1
155+
156+
$ curl -s http://localhost:20000/domain2 \
157+
| jq '.os.hostname'
158+
http-upstream2
159+
160+
$ curl -s http://localhost:20000/domain3 \
161+
| jq '.os.hostname'
162+
https-upstream3
163+
164+
.. seealso::
165+
166+
:ref:`Securing Envoy quick start guide <start_quick_start_securing>`
167+
Outline of key concepts for securing Envoy.
168+
169+
:ref:`TLS sandbox <install_sandboxes_tls>`
170+
Sandbox featuring examples of how Envoy can be configured to make
171+
use of encrypted connections using ``HTTP`` over ``TLS``.
172+
173+
:ref:`Double proxy sandbox <install_sandboxes_double_proxy>`
174+
An example of securing traffic between proxies with validation and
175+
mutual authentication using ``mTLS`` with non-``HTTP`` traffic.

‎docs/root/start/sandboxes/tls.rst

+4
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,10 @@ The upstream ``service-https`` handles the request.
170170
:ref:`Securing Envoy quick start guide <start_quick_start_securing>`
171171
Outline of key concepts for securing Envoy.
172172

173+
:ref:`TLS SNI sandbox <install_sandboxes_tls_sni>`
174+
Example of using Envoy to serve multiple domains protected by TLS and
175+
served from the same ``IP`` address.
176+
173177
:ref:`Double proxy sandbox <install_sandboxes_double_proxy>`
174178
An example of securing traffic between proxies with validation and
175179
mutual authentication using ``mTLS`` with non-``HTTP`` traffic.

‎examples/BUILD

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ filegroup(
1515
[
1616
"**/*.yaml",
1717
"**/*.lua",
18+
"_extra_certs/*.pem",
1819
],
1920
exclude = [
2021
"cache/responses.yaml",

‎examples/_extra_certs/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Extra certificates for config validation testing
2+
================================================
3+
4+
This folder contains certs that are referenced in the sandbox examples, that end users are
5+
expected to create themselves.
6+
7+
In order to test the related configs we need to provide the certs to CI.

‎examples/_extra_certs/domain1.crt.pem

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDhDCCAmygAwIBAgITAJlvbEs3wtayr3rx+TyuBtu0mTANBgkqhkiG9w0BAQsF
3+
ADBSMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExGDAWBgNVBAoMD015RXhhbXBs
4+
ZSwgSW5jLjEcMBoGA1UEAwwTZG9tYWluMS5leGFtcGxlLmNvbTAeFw0yMDExMTIx
5+
MTA3MDdaFw0yMTExMTIxMTA3MDdaMFIxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJD
6+
QTEYMBYGA1UECgwPTXlFeGFtcGxlLCBJbmMuMRwwGgYDVQQDDBNkb21haW4xLmV4
7+
YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA15Q63skf
8+
pc5o2mhBE0dOcJaTqLS+nmIO5jK8QUKctpbOQz2p7j9zi9ZUh++4N84yjF56GQEw
9+
/KqPvPHNA/tJKpkDugWHq4IFPU+o1k2AJKLVEvN3wXpbiae77eqgUCg0aS6kWDaT
10+
LrCie/laxnSpnfRGDo1xsLRqNLzZxF3CPvA/WbgpR1JXYUAnoXZGHISrnXLzyI1O
11+
DaDdDoi8Nn54neZ9jXtkeDWfuO5NkXK/U1dNnCez9a7EGO+h8ZF0Uc12UqPiX86L
12+
frK0v25n94lPTGq5SOgswATMSOfN6g4pGaUFofZIyenHamUngzqm55M+/tMeiaF7
13+
Pwf4wcTyXEaXcQIDAQABo1MwUTAdBgNVHQ4EFgQUTSuIMFANakAWSPIUiqdMUrFq
14+
66YwHwYDVR0jBBgwFoAUTSuIMFANakAWSPIUiqdMUrFq66YwDwYDVR0TAQH/BAUw
15+
AwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAdbdIBKAomEsGtcuWWc8vI4r0l+AMegGK
16+
yg86byKm9WRHtpYnO+iZ+SopTLTFhgLsGfEMoN+HGeUIexUvwDzb384EJ4kLPr3E
17+
Yqt5uNz9YMuFpkhuFTL+V5RczcPKfir5hzAgvAtj6eaRf9WPlObF+Rr0t8pJZG0k
18+
9dEtBqE87XVUDvj6waMCpTFxwv22E/xjRJ5nSDjfk9y8LDpIF5SOunncVMRVfcjg
19+
Qp0Q9KpZpbxXFMYVBfMxp4Z/KQd0W5nVWZlwg/D03n0IkS0e8irUyrerFLdOTwxf
20+
G5M/n/VeCwC2GPlT8Eo/3BUa+SeX2iHl93/osqfWNQAY3riaN0y+FA==
21+
-----END CERTIFICATE-----

‎examples/_extra_certs/domain1.key.pem

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDXlDreyR+lzmja
3+
aEETR05wlpOotL6eYg7mMrxBQpy2ls5DPanuP3OL1lSH77g3zjKMXnoZATD8qo+8
4+
8c0D+0kqmQO6BYerggU9T6jWTYAkotUS83fBeluJp7vt6qBQKDRpLqRYNpMusKJ7
5+
+VrGdKmd9EYOjXGwtGo0vNnEXcI+8D9ZuClHUldhQCehdkYchKudcvPIjU4NoN0O
6+
iLw2fnid5n2Ne2R4NZ+47k2Rcr9TV02cJ7P1rsQY76HxkXRRzXZSo+Jfzot+srS/
7+
bmf3iU9MarlI6CzABMxI583qDikZpQWh9kjJ6cdqZSeDOqbnkz7+0x6JoXs/B/jB
8+
xPJcRpdxAgMBAAECggEBALvIi+tKaH3mqaEuVRk08NfT4jV/k9ek9POCWEfEfXvz
9+
KyKZUS+OJ9k0TpfGscIypAdvuI2VYxWEgQaF3h7MwfQQK5XbgU1dSbEZdamPAsNm
10+
75G9cKChM6FZ8bKRwSlxjA3fKhsJFvYBuNei4naiYqmLgYbloJXa4fSkWFDblvt4
11+
cmsP9iEZL7tBJ4bIGmugpPR83PPlfu/EQY2w8T+Rw8/JAXDd80V1egCucYpwOx94
12+
esXVpWzTA3xZyPTlQrFmOe9NEb2C5oqOx1s/zmfQpytKPjF7YojnHnYeHrDL5Y+j
13+
sVP753celaYncWoANfAyV4FOxEsOa1OCKbF5OOuWPI0CgYEA/KyTK4NyRHqXrhuO
14+
J/rRDhhZBomP4LkY2uTMdOH+n0hvy0m5eV5+88CQF6atSfKQ8h+zbhJVNeVilZDK
15+
NhjAEm+x2vME41Wp1vqsALpPtuGFQm3EcwKDvTgyvm04X2RfZSZ4MT0993M/g07u
16+
x+VQiZu127PjcNibDXXoDwM5p/MCgYEA2mqoRnTr/DCrO8u678ccv8MYHhh0ISOs
17+
Tbmh83qROWehdoB6kRQ/i+kefbL6Rw0bY5+3rlvQ+3B3MvVoYLWUWuyhtYK2pt3i
18+
R071WPCuR3PIVOEK+wuHi85peiGSHxfEDiUb3AvNnd8dZGBFnHe8mZObccc7b4uy
19+
jT4VLJ56IAsCgYEAlg3GuKivS4uiWHt0yLljPYOoGwHGuCY0ZIpMAX3UwLM78PYv
20+
d6xuqENLT0Bk2O18ts2suUmZ4RAAo+IAtG+uYUSD0wtPc9KDsm/bhfMfM/RqNzEI
21+
4WQ06EJfoEcsmzn4jRFzf4pnKnT+2vQdSgkc8xvNvFPwVivMqQnEbmXz75ECgYBr
22+
BTfOzhuTRoWglwLR2k5L59w5YuIEGuaibwLbuoLODekfl3R3AeThOSinjrrzdYim
23+
F+x4kqSjj0fYwEaUnGRE6Q2TUqkMukvVhOrS2ZuLhz/x1xL6T3vrFQi5vxlKAusd
24+
wzETcPUfFePg+wsgz8qptZnE9ko5LcofSvw1ELHmYQKBgBfT1GtRlYCEMbuSJY20
25+
AtoOg5vN2b6s2nqQGff7J8UOywPDk9hyboL4ByS9Udemap0USisGAZiEfq+VbA+2
26+
lPhV/gmBFDidCCYRXKi6qfcDG9ssJ5Gylg/8XaaMKAQ7vp73sQYTDlcgUcPx90ue
27+
GMITMZWQr8Qs/u9zl22tnxAb
28+
-----END PRIVATE KEY-----

‎examples/_extra_certs/domain2.crt.pem

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDhTCCAm2gAwIBAgIUXBZV/SLVGAdsb1mJrpuahYegPLEwDQYJKoZIhvcNAQEL
3+
BQAwUjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRgwFgYDVQQKDA9NeUV4YW1w
4+
bGUsIEluYy4xHDAaBgNVBAMME2RvbWFpbjIuZXhhbXBsZS5jb20wHhcNMjAxMTEy
5+
MTEwNzA3WhcNMjExMTEyMTEwNzA3WjBSMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
6+
Q0ExGDAWBgNVBAoMD015RXhhbXBsZSwgSW5jLjEcMBoGA1UEAwwTZG9tYWluMi5l
7+
eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJfPje1r
8+
nUfVnHobHRKReisGdGWHQhngJlp3II7sPk0vRuvOLsyLp0AKA/pS0isW1WFUh+Kz
9+
BpOVrU/LPqi1ZW38mzCgGr91fc999vtsZyXOCEh7Vi3UVfzVtSNwnijlG3wovjGK
10+
DqLlne03/lPFT1x9coIy7XvA1ZICfX8EfP5ajt60+UWYXAKN2FLas9K+3lzzbHx5
11+
F/iI134A695ozLNHT1qe+IOA6NwW5LoTwzoHRVMoJz2cvSRr0vCVkt0IvO5ARyyr
12+
400Nx0vKkxhf0Z+yXGSowWVN8VtSPiRSeC4vGmPRl6O6XoiPwjus2jlXrJifcIyg
13+
hNDrOQnYbYK5dA8CAwEAAaNTMFEwHQYDVR0OBBYEFIQfS5xxWYX7pWgc59p+h6y8
14+
sQMFMB8GA1UdIwQYMBaAFIQfS5xxWYX7pWgc59p+h6y8sQMFMA8GA1UdEwEB/wQF
15+
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAIHDjt+wxYuOJkI8VncVR6VpGy9hqntd
16+
rnNxupReenhocPN/QIl1TQva/gGq4gz1vNWhHz1B5bxPoyPESed5+QQvJMo3/5Ub
17+
OyDIKwspwRy6PUoyJDjhC/z7B2FhZPmxVmbHfhL0wiQjI7j/u+/c8Jq9YDr8ZsZs
18+
whXjvSOl9+I0xWZFRN0O+cFszTnoucmLRdFVl648ghUlW3m6/YNWF+mLucleZVt3
19+
wFUKGwq88Z4sU6kqcXXG4GykZYmSwB3BmaaamQKq06v+k9Qjrj5gJD8S1Ygznc6/
20+
Z+ZzAb/FfHXHV6QbY5/35wVFO3OMk6NHy9oLZrfPxBn/C5brUz+dXnI=
21+
-----END CERTIFICATE-----

‎examples/_extra_certs/domain2.key.pem

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCXz43ta51H1Zx6
3+
Gx0SkXorBnRlh0IZ4CZadyCO7D5NL0brzi7Mi6dACgP6UtIrFtVhVIfiswaTla1P
4+
yz6otWVt/JswoBq/dX3Pffb7bGclzghIe1Yt1FX81bUjcJ4o5Rt8KL4xig6i5Z3t
5+
N/5TxU9cfXKCMu17wNWSAn1/BHz+Wo7etPlFmFwCjdhS2rPSvt5c82x8eRf4iNd+
6+
AOveaMyzR09anviDgOjcFuS6E8M6B0VTKCc9nL0ka9LwlZLdCLzuQEcsq+NNDcdL
7+
ypMYX9GfslxkqMFlTfFbUj4kUnguLxpj0Zejul6Ij8I7rNo5V6yYn3CMoITQ6zkJ
8+
2G2CuXQPAgMBAAECggEAJ089Rv8YqOMtM4kVzBsTcVSoiyms+hpKlB5ItfmCYGYf
9+
jSvEfn6i/jgZs5YCidnNwvgqf48v4sNdL05HmVPvQb2pSbwLcQwxWasaaxw00Vs6
10+
VdpqBE/5PBDyaIzex2Qb69h490byZ0fhzu0y0+pBlId/QSuCxwq1wqsWZ+93ljzi
11+
rDDoPSWcty0R3QWrMUmbihi6i8v8fbFz174jxGH1TRJ0+a9IuGZ9Yap1mSg9YC/0
12+
oM20lsvmQvczXYdJMUhg0CYJ3weThO9pK4fnDa7pvkBgxgOTOY2TZh3PUs7DmYa7
13+
YCE5xp8CviKZywaAqvowjfdWj8yCU5ZFzN4LdDmhMQKBgQDHL/dUg61+viWR7GyD
14+
Kb9E9FjktwSu52Ec1jfcjFe8UkRJa7JiruagVXuekAVvA+R7ZifSb0Yfs1QaHwA3
15+
NPvVpwb3omW02gfbXR9AJ/eEJfgkcliPrJsL0QqbLu+w+5CFaj/iCN5SxE822WLx
16+
3dGNDOrQEr0A+K3Hmj5SCtCmbQKBgQDDHEwxzjq6jw2n+K0ArIvpXa1/hteT6h1q
17+
7Qcg9nEaSiVbYAfp+1qgQqoCMe7aSNJe/RuGP59mwlIgt1rn+QFgb8K9IoZYvb4N
18+
jwLmuOx1tLWtbRLHHFdYA14XlwKOl79NwjJPepCZIU8eOzaDLBUUeH0DkgJgwSZ2
19+
TnJOmp6m6wKBgHL0tNpa0INoPAiWmR2tt0yVdMQy+An1UW+yFjU77dqq4+w3spEP
20+
fdyk2R5u4iPq7C9niq4BOEhNV8lngNlbw8fPiM7cM7SHbKdmfAWry0bCHw7xyzjI
21+
Fgdg0q0zDnRnC0ZkRpAuLBk6YLk4BsmuCiVMgiwp1Fi+LJUY6MSypy6VAoGAUFun
22+
RhwaNBwXE8dn+Y8XUNY0TwHKaDFUTGWzOfBGRP2kxS2YFNZhTQAn5R+LsHutqVG1
23+
tGUf0cLW8IKT/lagKofdPOirTIFZdVwhZcVkHlZ/PR5fTYJutuEsL6sScogtUmlZ
24+
L0LbqzX80AazPPM6+2NkmcPZFuB2ZuOIULd+AGECgYBt40PiCf1WmAQK9J3pylOD
25+
s7kWwzapIAKf92JBJmo5sOushYsPXAnqUJaZERpBBCmsdtYyjQV8VYxg/CrU5CkE
26+
0zdFmFcfw7swwaE+aJLwueV1qR7lKi89DYZ9OFI+Z0JoekQc/TPeJLg1MctK76qA
27+
OMswum0oXiu/zZJGGtCegg==
28+
-----END PRIVATE KEY-----

‎examples/_extra_certs/domain3.crt.pem

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDhTCCAm2gAwIBAgIUI/iTc/yKhX+HkiDCKAuCa25fxQwwDQYJKoZIhvcNAQEL
3+
BQAwUjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRgwFgYDVQQKDA9NeUV4YW1w
4+
bGUsIEluYy4xHDAaBgNVBAMME2RvbWFpbjMuZXhhbXBsZS5jb20wHhcNMjAxMTEy
5+
MTEwNzA3WhcNMjExMTEyMTEwNzA3WjBSMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
6+
Q0ExGDAWBgNVBAoMD015RXhhbXBsZSwgSW5jLjEcMBoGA1UEAwwTZG9tYWluMy5l
7+
eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOO0k18
8+
6k3164UpYGVOC1oj8jbmdZeeg57mkamYE9CUk0W9KKgHOCSNMZXUxPtnqtqJgJ92
9+
ccawTe0WrbOKQA3ARK7WePbX3HepJfTFZgCC5d5njRPDfIgsk4MP89nc2p8qO5Vv
10+
SvCTae8/ykTyfz5fKwaGMYwvrSGUpuhFD8OFMOAsvnoIXZd+ixLkDATupP/IaV0a
11+
6tHs6BnC3vxn+baC30fuHKErfOh7Jlo3FDqXNMwfes6MJ7/u8odeFfuGOaaO4eRT
12+
EAhy4VQBJkCtS3yCFEv3kCRXjmgEBDSQ9jDjtnykOqViO5euibeKxnz+7xjRWVGY
13+
bT5Z+s6eUHkiraMCAwEAAaNTMFEwHQYDVR0OBBYEFDVYD/F+NzsKgfYsRM6XfMuB
14+
qXmqMB8GA1UdIwQYMBaAFDVYD/F+NzsKgfYsRM6XfMuBqXmqMA8GA1UdEwEB/wQF
15+
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBABwiF5AVDmQTLYE4wuHxq245qOj/vKfi
16+
1L2lNgZ7G2Luobbvli2SQo7g8UYMSrwNF3Y1TDoEryeYMKYr2udb8WvdzhlL3z/J
17+
a/qBElwWsATnpRfBAqxeWkx0x0E0C4nrjXM7PbAEjvEZ2AQKc5zmvii1Ek4h/+Sa
18+
h2+Tmm5zg0Lo410CqujRmGtHU2AtkqguOhNrvJcRxEH4iLDB87WfUlLW6JrN+CLB
19+
qIxkyLlhMUNMa200mpsfwQQRdImTjdn+VgpFR9BeZYU2gPZxqdxKcyrGfYXim1oJ
20+
dC34TKistMWFs0C3l+Xs7unqSkqk5s1Nkdh6vnMF39PkwFoVP3Nn2wY=
21+
-----END CERTIFICATE-----

‎examples/_extra_certs/domain3.key.pem

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDDjtJNfOpN9euF
3+
KWBlTgtaI/I25nWXnoOe5pGpmBPQlJNFvSioBzgkjTGV1MT7Z6raiYCfdnHGsE3t
4+
Fq2zikANwESu1nj219x3qSX0xWYAguXeZ40Tw3yILJODD/PZ3NqfKjuVb0rwk2nv
5+
P8pE8n8+XysGhjGML60hlKboRQ/DhTDgLL56CF2XfosS5AwE7qT/yGldGurR7OgZ
6+
wt78Z/m2gt9H7hyhK3zoeyZaNxQ6lzTMH3rOjCe/7vKHXhX7hjmmjuHkUxAIcuFU
7+
ASZArUt8ghRL95AkV45oBAQ0kPYw47Z8pDqlYjuXrom3isZ8/u8Y0VlRmG0+WfrO
8+
nlB5Iq2jAgMBAAECggEBALe2MUzIP9kTYLlNIJiq07FPuZjnsarJKD8bvdWD34GA
9+
QkYuqMYJWi3EUsO+CXtgbTo2GJY1kDcmo15Kgs3636fLavqQ0zyZlyz2w4iJ9QQf
10+
9FCWGQtrB09qCP4D+4I8n0kNRMJithUBd3BiDePtp6nxf5r2cA+RLmUwoAft8Rws
11+
GoZF5vm93iHF29H/nbP7KNTyBAoRq95y+SiXvcLOb9pN5IwAiqkAcVF8YpUCqsQL
12+
PRTJZupSRU3Cg0Asq9nvqxeTBrySeOkoRid9b/5/MKP2CXNkGoOl7TCiHJ1SFYCd
13+
waN+516Nd6Hu8WpH7n3eqcc/JhmP7jLv3vqLYAWpJ/ECgYEA9XigdnEiGFuP/SAE
14+
l8InIGfNxGegEb9AMifZdir4lI1BKC+Ke84TD0V5tgHS5zsk8SOAIERHrclOTtHR
15+
WPEx+GDrsukl3QDisdFE6sU1ktZ9S0uim9hYGaAtxME99U3EhDTBLApNyhxe2REC
16+
yZoCuObqz7OVCu+SZ6/etw5mk+kCgYEAy/IgXJxCD3ais1Jy0DOfrzSExXulOi4X
17+
+EWtMNcBkcYxE0Jl1mpsgd7GZNnJCf8ThajetREPFYzMCYiI6KOtOJBi+Bil6hpI
18+
N2U29LD/dxIotHzdIau4ESFODJdgP2agzFx72JDKEBxGsuc7x5bd7P8hex+XURTW
19+
KVuawJPXOasCgYEAoYXCcK149fYqBTGwU/vZqyUi7P4TAhqKr3YxTeRwta9NFJhT
20+
06uCNyZMNEt279inMlVd1d2YHO69rHe7/X6YlwuPjKaF16rhgIhnhORHoFurDoSy
21+
d0IglpwkAbf2gRevHB9qjQQqs7d/Ye4jm2zQJcMs94b/p7aE6915+5JqRSECgYAo
22+
uC4n73btGXXAsfyEf1oppCXCPD6wEBXvFxJORw9kKJsRylcE6XjCsVURO759BXXD
23+
YQUeR8qoNdVjLeSP9mYWfhWUjW9K/3ZdwRKo5lILVw/TgX6xQ1Tb7rdjojGwVvBR
24+
/UEo6ze84bhn7e0sm32x3Pq1V4hhwvRDi6upOZtmQwKBgQDbjiPYdqKkbrC7YFsH
25+
4m9VenSmnOppugcYU5h3zLORERfuTBT4cT2TEZT4zlz1vUZFjoQ5ML97xSGeCKzN
26+
0Y0uh6zRgoy2zAQzwmtrNi80GuFEv1CJq7qxzz3aDU2Y/qYFmnl2cTwLNC+MxpbJ
27+
lpvH9Ufkaj4vu/Iuw/Dnc2BPQg==
28+
-----END PRIVATE KEY-----

‎examples/tls-sni/Dockerfile

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM envoyproxy/envoy-dev:latest
2+
3+
COPY ./envoy.yaml /etc/envoy.yaml
4+
COPY ./certs /certs
5+
RUN chmod go+r /etc/envoy.yaml \
6+
&& chmod go+x /certs \
7+
&& chmod go+r /certs/*
8+
9+
CMD ["/usr/local/bin/envoy", "-c", "/etc/envoy.yaml", "-l", "debug"]

‎examples/tls-sni/Dockerfile-client

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
FROM envoyproxy/envoy-dev:latest
2+
3+
COPY ./envoy-client.yaml /etc/envoy.yaml
4+
RUN chmod go+r /etc/envoy.yaml
5+
6+
CMD ["/usr/local/bin/envoy", "-c /etc/envoy.yaml"]

‎examples/tls-sni/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
To learn about this sandbox and for instructions on how to run it please head over
2+
to the [Envoy docs](https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/tls-sni.html).

0 commit comments

Comments
 (0)