Question: CA certificates used for client certificate verification

When mTLS is used, the set of valid CA certificates is initialized from the systems certificate pool:

https://github.com/luraproject/lura/blob/1f33ebaccd6185a97eb98c424b62a18386329c11/transport/http/server/server.go#L145-L157

If my understanding is correct, these are the certificates stored in e.g. /etc/ssl/certs. On my system there are 138 CA certificates installed.

My questions is: is potentially any client certificate signed by one of those 138 CAs accepted by default? If so, what is the proposed way to narrow the list down to only use my issuing CA?

Hi @jandelgado ,

This should be fixed in #613

Thanks for reporting!

This issue was marked as resolved a long time ago and now has been automatically locked as there has not been any recent activity after it. You can still open a new issue and reference this link.