Certificate revocation list (CRL) support for the mTLS authentication

[SudhakarNandigam-TomTom]

Description:
Add Certificate revocation list (CRL) support for the mTLS based authentication between external clients and the Gateway.

[arkodg]

ClientTrafficPolicy.spec.tls.clientValidation is a good home for this feature

gateway/api/v1alpha1/tls_types.go

Line 112 in decd878

type ClientValidationContext struct {

[guydc]

Hi @SudhakarNandigam-TomTom - can you elaborate on the expected UX here? Many proxies require the operator/control-plane to provide a CRL file (see examples here: nginx, haproxy, envoy), while CRL processing specs typically expect proxies to fetch CRLs online based on the CDP extension of certificates and cache them.

In your case, do you intend to provide the CRL as an input to Envoy Gateway?

[SudhakarNandigam-TomTom]

Hi @SudhakarNandigam-TomTom - can you elaborate on the expected UX here? Many proxies require the operator/control-plane to provide a CRL file (see examples here: nginx, haproxy, envoy), while CRL processing specs typically expect proxies to fetch CRLs online based on the CDP extension of certificates and cache them.

In your case, do you intend to provide the CRL as an input to Envoy Gateway?

Hi, My requirement is Envoy gateway fetch the CRL file from the URL and use it for mTLS. But most proxies does not support it. So I am also okay to provide the CRL file to the Envoy gateway.

[saj235]

Hi @SudhakarNandigam-TomTom - can you elaborate on the expected UX here? Many proxies require the operator/control-plane to provide a CRL file (see examples here: nginx, haproxy, envoy), while CRL processing specs typically expect proxies to fetch CRLs online based on the CDP extension of certificates and cache them.
In your case, do you intend to provide the CRL as an input to Envoy Gateway?

Hi, My requirement is Envoy gateway fetch the CRL file from the URL and use it for mTLS. But most proxies does not support it. So I am also okay to provide the CRL file to the Envoy gateway.

+1
I have the exact same requirement.