-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow requestCert option to be set #38920
Conversation
This allows you to pass the option in correctly to the constructor
Pinging @elastic/kibana-platform |
💚 Build Succeeded |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
This allows you to pass the option in correctly to the constructor
@@ -49,6 +49,7 @@ export const sslSchema = schema.object( | |||
schema.oneOf([schema.literal('TLSv1'), schema.literal('TLSv1.1'), schema.literal('TLSv1.2')]), | |||
{ defaultValue: ['TLSv1.1', 'TLSv1.2'], minSize: 1 } | |||
), | |||
requestCert: schema.maybe(schema.boolean({ defaultValue: false })), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@toddself Hmm, IIRC you either use schema.maybe(schema.boolean()) // requestCert?: boolean
or just schema.boolean({ defaultValue: false }) // requestCert: boolean
as having default value implies "optionality". Or I'm missing something?
Summary
Allow
new SslConfig
to accept therequestCert
boolean option to bepassed into the constructor.
Checklist
Use
strikethroughsto remove checklist items you don't feel are applicable to this PR.This was checked for cross-browser compatibility, including a check against IE11Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n supportDocumentation was added for features that require explanation or tutorialsUnit or functional tests were updated or added to match the most common scenariosThis was checked for keyboard-only and screenreader accessibilityFor maintainers
Dev Docs
This allows us to require an HTTP server created by Kibana to force a
client to provide a certificate for authorization to the server
instance. This enables PKI-based mutual TLS for client/server
interactions
Creating a configuration as such:
Would require a client to provide the same
cert
andkey
(andca
ifit's a self-signed certificate) to the https request in order to the
server to respond:
Without the same certificate, key and ca, the Kibana server will reject
the request as being unauthorized