Add support for using SSL client certificates when making target HTTP requests.

[kevinswiber]

This should be a fairly straightforward change. We'll have to add configuration options for key and cert files per host. Then we can update the HTTP agent to use these based on the hostname for the backend request.

[kevinswiber]

An early Pull Request is ready for testing here: #11.

[kevinswiber]

These changes have been pushed to edgemicro@2.1.0-beta. @srinandan has been testing it out and will report issues here.

To install: npm install -g edgemicro@2.1.0-beta.

[zcmack]

installed this and am working with it now. attempting to hit a node service running on another machine on the network, getting the following error response. {"message":"write EPROTO","code":"EPROTO","errno":"EPROTO","syscall":"write"}.

I can send you my configuration file if you'd like but I'm wondering if this has to do with using a self signed certificate or not?

[srinandan]

I think it might be something else. Self-signed certs should work. You should set the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0 if you're using self-signed certs.

Please do send us the configuration file.

[kevinswiber]

@zcmack It definitely seems TLS related. I just had a thrilling read through this very long thread: nodejs/node#3692

[asnowfix]

Usually I get this (misleading) error from EMG when it unsuccessfully tries to directly reach an SSL site while it should use a proxy...

[zcmack]

so i created a different express service on my local machine and secured via https. loaded in my certs and am now receiving {"message":"self signed certificate","code":"DEPTH_ZERO_SELF_SIGNED_CERT"}

i included rejectUnauthorized: "false" in my conf file, but I'm still having issues.

[srinandan]

Please set environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0

[zcmack]

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; is the first line in my
node service.

On Wed, Sep 21, 2016 at 4:52 PM, Srinandan Sridhar <notifications@github.com

wrote:

Please set environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#9 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AGFBdi7p46ejUHktcmGnwOa5Nx_4bxSUks5qsacpgaJpZM4J1_BE
.

[srinandan]

Try setting it as an environment variable (outside of node.js).

[zcmack]

tried it as an environmental var with no luck. i added rejectUnauthorized=false to my config file and my service and specified the ca in both places as well. My error message changed to

{"message":"self signed certificate in certificate chain","code":"SELF_SIGNED_CERT_IN_CHAIN"}

Any other ideas?

[zcmack]

ok so i was able to get this working by setting the environment variable on the EMG rather than the server, my bad. I am curious how we can configure this to use bi-directional SSL. How can I configure a truststore on the EMG?

[kevinswiber]

@zcmack You can point to a file for the CA.

targets:
  - host: 'example.com'
    ssl:
      client:
        key: '/location/of/key'
        cert: '/location/of/cert'
        ca: '/location/of/ca'

[kevinswiber]

@zcmack It might be worth keeping an eye on this Node PR, as well: "crypto: use system CAs instead of bundled ones" (nodejs/node#8334). It hasn't been merged yet.

[gealogojoemarg]

@zcmack You can point to a file for the CA.

targets:
  - host: 'example.com'
    ssl:
      client:
        key: '/location/of/key'
        cert: '/location/of/cert'
        ca: '/location/of/ca'

@kevinswiber

When i tried to configure 1 way ssl, i encountered this error.

{"message":"self signed certificate","code":"DEPTH_ZERO_SELF_SIGNED_CERT"}

below is my configuration

edgemicro:
port: 8000
max_connections: 1000
config_change_poll_interval: 600
logging:
level: info
dir: /var/tmp
stats_log_interval: 60
rotate_interval: 24
plugins:
sequence:

• oauth
  targets:
• host: 'dev.test.com'
  ssl:
  client:
  ca: '/home/vagrant/dev.test.com.jks'
  passphrase: ncsiph2019
  rejectUnauthorized: false

Hope you have an idea on this error.

[dawncold]

@gealogojoemarg You should make sure your targets config on top level instead of under edgemicro, like this:

edge_config:
  ...some configs...
targets:
  - ssl:
      client:
        ca: '/path/to/your/self/signed/certificate.pem'
edgemicro:
  request_timeout: 7
  port: 8888 #or 8080  #NOTE: never use one of these ports for your backends!!!
  max_connections: 1000
  max_connections_hard: 5000
  config_change_poll_interval: 600  #seconds
... others configs...

If you write it under edgemicro, you will get an empty targets after this line: https://github.com/apigee/microgateway-core/blob/master/lib/config.js#L15

and maybe the documents should be updated, it confused me several hours: https://docs.apigee.com/api-platform/microgateway/2.5.x/operation-and-configuration-reference-edge-microgateway#usingclientssltlsoptions

[relloller]

@dawncold Thanks for the post. I spent some time on the same issue but didn't get a chance to request the doc update. I have just filed the ticket.