ingress-nginx
ingress-nginx copied to clipboard
kubernetes
allow proxy certificate in ingress-nginx, openssl X509_V_FLAG_ALLOW_PROXY_CERTS is not set
With ingress controller v1.3.0, with a certificate (see command 1), it works ok. But if trying a x509 proxy ( see command 2), it will fail with error "400 The SSL certificate error". When using "--v=5" to enable debug mode, in the ingress controller logs, I found some thing like "40:proxy certificates not allowed, please set the appropriate flag". It seems we need to set openssl X509_V_FLAG_ALLOW_PROXY_CERTS flag. I cannot find any documents how to set this flag. Could you help allow proxy certificate in ingress-nginx?
(1) curl -iv -k --cert ~/.globus/usercert.pem --key ~/.globus/userkey.pem --request GET https://test-dev-rest.local:443/test (2) curl -iv -k --cert $X509_USER_PROXY --key $X509_USER_PROXY --request GET https://test-dev-rest.local:443/test (3) 2022/07/29 09:06:35 [info] 33#33: *241 client SSL certificate verify error: (40:proxy certificates not allowed, please set the appropriate flag) while reading client request headers, client: 188.185.34.228, server: test-dev-rest.local, request: "GET /test HTTP/2.0", host: "test-dev-rest.local"
@wguanicedew: This issue is currently awaiting triage.
If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle stale - Mark this issue or PR as rotten with
/lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Reopen this issue with
/reopen - Mark this issue as fresh with
/remove-lifecycle rotten - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
@k8s-triage-robot: Closing this issue, marking it as "Not Planned".
In response to this:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied- After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied- After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closedYou can:
- Reopen this issue with
/reopen- Mark this issue as fresh with
/remove-lifecycle rotten- Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.