-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Description
Title: Envoy Server drops the connection on Windows when the client certificate is invalid
Description:
When the client certificate is invalid the behavior on Windows and UNIX is different. On Linux (correct behavior) it notifies back the client and on Windows it just drops the connection.
- UNIX: SSL_get_error is SSL_ERROR_SSL and the client has the error TLS error: 268436501:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_EXPIRED in its error queue
- Windows: SSL_get_error is SSL_ERROR_SYSCALL and a WSAGetLastError of 10054
Information provided by: SSL_CTX_set_info_callback(ctx.ssl_ctx_.get(), apps_ssl_info_callback);:
On linux the alert that is raised is:
SSL error[undefined][TLS client read_session_ticket]: ret: 557 alert type fatal alert desc certificate expired
On Windows the alert that is raised is:
SSL error[SSL_connect][TLS client read_session_ticket]: ret: -1 alert type unknown alert desc unknown
Repro steps:
Run the test case FailedClientCertificateExpirationVerification in //test/extensions/transport_sockets/tls:ssl_socket_test
cc: @envoyproxy/windows-dev