Skip to content

Envoy Server drops the connection on Windows when the client certificate is invalid #13191

@davinci26

Description

@davinci26

Title: Envoy Server drops the connection on Windows when the client certificate is invalid

Description:

When the client certificate is invalid the behavior on Windows and UNIX is different. On Linux (correct behavior) it notifies back the client and on Windows it just drops the connection.

  • UNIX: SSL_get_error is SSL_ERROR_SSL and the client has the error TLS error: 268436501:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_EXPIRED in its error queue
  • Windows: SSL_get_error is SSL_ERROR_SYSCALL and a WSAGetLastError of 10054

Information provided by: SSL_CTX_set_info_callback(ctx.ssl_ctx_.get(), apps_ssl_info_callback);:

On linux the alert that is raised is:
SSL error[undefined][TLS client read_session_ticket]: ret: 557 alert type fatal alert desc certificate expired

On Windows the alert that is raised is:
SSL error[SSL_connect][TLS client read_session_ticket]: ret: -1 alert type unknown alert desc unknown

Repro steps:

Run the test case FailedClientCertificateExpirationVerification in //test/extensions/transport_sockets/tls:ssl_socket_test

cc: @envoyproxy/windows-dev

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions