Commits on Apr 2, 2021

1. Support ssl_reject_handshake in Ingress and VS …

   To handle missing or invalid TLS Secrets in Ingress and VirtualServer
   resources, previously the Ingress Controller would generate the
   following configuration:
   ssl_certificate /etc/nginx/secrets/default;
   ssl_certificate_key /etc/nginx/secrets/default;
   ssl_ciphers NULL;
   
   The configuration will break any attempts for clients to establish
   TLS connections for the affected server in NGINX.
   
   The configuration has the following limitations:
   - It requires a TLS cert and key (we used the default server Secret as
   it was always present on the file system)
   - It doesn't work if clients and NGINX use TLS v1.3: NGINX will terminate
   TLS connection.
   
   This commit introduces the new ssl_reject_handshake directive, which
   configures NGINX to break any attempt to establish a TLS connection:
   ssl_reject_handshake on;
   
   The directive addresses the mentioned limitations: it doesn't require
   a TLS cert and key and works with TLS v1.3.

   

   pleshakov committed Apr 2, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 2ae6e26
   • Browse repository at this point

   Copy the full SHA

   2ae6e26 View commit details

   Browse the repository at this point in the history