Custom handshaker extension: can it be used to implement dynamic tls termination

[vorishirne]

Description: I want to implement client side forward proxy, for which i may need to generate certificates for each domain that user has requested at runtime. Need help if Custom handshaker extension is not what I am looking for. If yes, what are your suggestions to make my requirement possible with envoy

[vorishirne]

@htuch pls help if that would help or pls refer the right person to ask this.

[htuch]

@ggreenway

[ggreenway]

I think this is asking for the same thing as #18928. @vorishirne does that sound correct?

[vorishirne]

Oh thats an exact match.He is having that as part of a listener filter.
Is that also possible via overriding this entire function

const std::string& ConnectionInfoImplBase::subjectLocalCertificate() const {
  if (!cached_subject_local_certificate_.empty()) {
    return cached_subject_local_certificate_;
  }
  X509* cert = SSL_get_certificate(ssl());
  if (!cert) {
    ASSERT(cached_subject_local_certificate_.empty());
    return cached_subject_local_certificate_;
  }
  cached_subject_local_certificate_ = Utility::getSubjectFromCertificate(*cert);
  return cached_subject_local_certificate_;
}

[lambdai]

cached_subject_local_certificate_ = Utility::getSubjectFromCertificate(*cert);

Interesting. This subjectLocalCertificate is supposed to be called after the handshake is done. To drive the handshake, you need a certificate.

I am not sure how you'd like to moving forward with a new subjectLocalCertificate() impl

[vorishirne]

Any function that would ask for the certificate to send to the client. I want to tweak in that.

[vorishirne]

But now I think the dedicated change from above mentioned issue are already the suitable ones. Will try them only