diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go index 399087cb71..c7de5de62e 100644 --- a/test/e2e/e2e_test.go +++ b/test/e2e/e2e_test.go @@ -41,7 +41,6 @@ func TestE2E(t *testing.T) { skipTests := []string{ tests.GatewayInfraResourceTest.ShortName, // https://github.com/envoyproxy/gateway/issues/3191 - tests.BackendTLSSettingsTest.ShortName, // https://github.com/envoyproxy/gateway/pull/6029 } // Skip test only work on DualStack cluster diff --git a/test/e2e/testdata/backend-tls-settings-client-cert-rotation.yaml b/test/e2e/testdata/backend-tls-settings-client-cert-rotation.yaml index 03ac6f32db..de0492570d 100644 --- a/test/e2e/testdata/backend-tls-settings-client-cert-rotation.yaml +++ b/test/e2e/testdata/backend-tls-settings-client-cert-rotation.yaml @@ -1,20 +1,13 @@ --- +# This is used as the client certificate for the envoy to connect to the backend service +# openssl req -out envoy.csr -newkey rsa:2048 -nodes -keyout envoy.key -subj "/CN=envoy/O=example organization" +# openssl x509 -req -days 36500 -CA ca.crt -CAkey ca.key -set_serial 0 -in envoy.csr -out envoy.crt apiVersion: v1 -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFVENDQWZrQ0ZGZ1A5ckEyNFA2NnhXcDRQSnEzY05KdHJYRXBNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1FVXgKQ3pBSkJnTlZCQVlUQWtGVk1STXdFUVlEVlFRSURBcFRiMjFsTFZOMFlYUmxNU0V3SHdZRFZRUUtEQmhKYm5SbApjbTVsZENCWGFXUm5hWFJ6SUZCMGVTQk1kR1F3SGhjTk1qUXdOakF5TVRnMU5ESXlXaGNOTWpVd05qQXlNVGcxCk5ESXlXakJGTVFzd0NRWURWUVFHRXdKQlZURVRNQkVHQTFVRUNBd0tVMjl0WlMxVGRHRjBaVEVoTUI4R0ExVUUKQ2d3WVNXNTBaWEp1WlhRZ1YybGtaMmwwY3lCUWRIa2dUSFJrTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQwpBUThBTUlJQkNnS0NBUUVBblpYeHQ0Tk5TQVYxT2YyWDBDY1E2clk1eUlKQjRVWlkzVytPSlpQZmZtT0xZSFE5Cld6ZEQyUStCdHpocHNnVmhuZ25XZjVCeDlzbFExakdmSWY3eGFJbDNHcE13S3dsbk1mRlB6d0lxcTc1MHV4bzIKcU9QV1VwTHhoWXl4eVVHU0xXeTZuZ1RHOTBnRjM2MUNsWkJqVWxML2g3M2VHSmMydERVWG85T1k1SFhJc0hnbwp0WlJTWXdJV1kwbjgyMmFTT0tPTCtBeDc0eVV3ODMwSnRxK1RmbDlCbjFZMWNZVjgrNDZqVnhodzBVWHlac1diCk5CdllzQk1jZmFVcmdyWjlSVXYzYlJuNS9kUVFlanMvRzJVOGlmNW9qR0NaSG5nUEFLV0NyS0MxejU1RmVYbEgKSDR1cVJ5ZGRKL1IyYUVsYnkyeUhrSmVEaFRjQmhxUXFIT2dMU1FJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQQpBNElCQVFBTU1ldzg2dmVrM1hpdGNUd25lcnlNOUU0MjVCOVYrd24ya2swYTFNMDhlSGhNU2xHREQ4bG5mb1hKClNhZHEzbStBSlgyNHByZTBJQkMzRlhXajBrdCt5ZXN1dCtQR01jaHR1YXJYOU1PakpPRVk1NFFCRUdBNXJ0TzgKRWM0bWdqNkkzSGxGa2RTbUVkZTJjVTFPMDFlU3JZZG9vWUpmc2RLN1drUWEzNElRb1lPREhPbUFnMnluaVhZbQppSXZaUHkzUHdYSnN5VFNpYi9BMXQ3WEpoS3RIdUxvWGxPTHpVSUFMVkZsRzRNQjRreHcrMlVueFZHdjI0NUg0CjFsTnVaRk1BSXhWMXdZYkplbTFUT1ZLcFdMVmVqWE85SWZvcks1VmdqVzV2TkM1ejU3Um41dDljSGwxUHVhVmQKYk01U2ozU2pMWW52cXNQZ2JReXAxdWc3UEJBUwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2RsZkczZzAxSUJYVTUKL1pmUUp4RHF0am5JZ2tIaFJsamRiNDRsazk5K1k0dGdkRDFiTjBQWkQ0RzNPR215QldHZUNkWi9rSEgyeVZEVwpNWjhoL3ZGb2lYY2FrekFyQ1djeDhVL1BBaXFydm5TN0dqYW80OVpTa3ZHRmpMSEpRWkl0YkxxZUJNYjNTQVhmCnJVS1ZrR05TVXYrSHZkNFlsemEwTlJlajA1amtkY2l3ZUNpMWxGSmpBaFpqU2Z6YlpwSTRvNHY0REh2akpURHoKZlFtMnI1TitYMEdmVmpWeGhYejdqcU5YR0hEUlJmSm14WnMwRzlpd0V4eDlwU3VDdG4xRlMvZHRHZm45MUJCNgpPejhiWlR5Si9taU1ZSmtlZUE4QXBZS3NvTFhQbmtWNWVVY2ZpNnBISjEwbjlIWm9TVnZMYkllUWw0T0ZOd0dHCnBDb2M2QXRKQWdNQkFBRUNnZ0VBVVN0ejl4K2x4ZXd4eHE0TjdZVEIzUFFCN1hyU3JsUEs0RHhlenBKTmMwK1kKOGhUTnFkZGNsa2k3ZXdHT3g4aW4wSHlteE14Rk4yWFl3b3VLdVRzVlk5QXl6amgwZmlaNHhpdlMvUURUcytVRgpRWDZ1R3U1SWJmNE1jOHJWcEtHbXhza1RrdU5KRFFSSEtrQ1haR3ljREVKK0pwQXcveCtjYU5SVUdlbWEva215CklrZ0FRMUpxQ1lFNTJKUG1PWGRhL3VjMEJtMGYyQkFZUmh6V3JmRGV4SnlzelloMDdhNHNWVW9FRXlxbjlFV2EKbVZOQkV2SzQwVm1KVFcyV1ZuN3lZUnk2OUgvbGl2cGZWdG1RbE9SaVBkYXRaK1RUaXA2VHF2SFIwNHZyam1pMApQUXdhbkJmN3Z6aE9SU3Z1VDhOUEtWV1pkeHAxQm1JaWtrUmpSYjRyMFFLQmdRRE0yaWk5QXowZDVSbnZzV24zClJrWlNZbG1CaHhROGFKajBqY1l0cHBycEQ3ZFgvbGh4dDRHNFBSVWx5QTcwSmFMOVBrTVhZcklhNlpJMUQyRC8Kb2ZSbFoybE9HMUtnVVVTUW42bFFiaWo3NkdyaFhlOXhvRDE5eEdEai9HWTFSRDB1VGI5OWhtU1lyVzJySnREQwpMWG0vWUV1TjJGc2N4Q3QzOHhBVWl1bzZiUUtCZ1FERTdwV1laa3RzeXcyTkJhRmo1NXZJYkcyVjhkUk9vdzFsCnY4cWxsMllHWXpHWEJzNlBodzlGMUNzcjl4dm9HNmhPR1hFNmxOL25RZGtxTEtONEJqM25lNXZJMGUxKzI0TG0Ka0lZK0ltTWo1U2w4QzFuUzR3MVFVTlREYWIyakhackFXd0hJQlBUdFYzbDdMY3cvQXh5NnRjcVJ2alpoQjVnZAplL1N3RStzS3pRS0JnQm5wbHJHaUVUOFExZUVPRGh0clZrWGhqdlRsZzFmSTIyQkQ5c2ViaFlqcHBnV0pkT0tkCmxka2FVT3lBaS9PeU54WFZwR0wyNXhTa2F3d3ZMOVBtUnFYMUdNcjZoYzhsdUlpYXlhNFU0VFpNUmdqUCt4UGkKY3lUUGpIb0tXVnR2a0ZXbEhBM2l6Q0xML1UxakVaRWVjNElUeWpyZEhWbGNMeXR6SVp1WG50MVpBb0dBQUxsago0WENXM0dxT3ZUTUZHZW56SDdTT1hwdktEUlA2YTZKZDYyZjRIeFBrVGNyZm5aV0FqK0FzM0hlSEtiNVlTeGs2CjJsMUx5WHpyZ0lVemdMQjlMOG03ayt4NXRCcTRpNEtDaTkzeWdXSkpXY1JzNnlLY25Pdi9MRXpLUHJ4UUlsN3oKVGJuKzhKUit4TjR4UHhZUzEvanRLc1lKU3lnTS9pYkRpcFk0S2cwQ2dZQmExL0RYQlVIVWI3UlFWcVBrdVJsYQpHenhVeTd4c3dXQkNVbWtkNkdyUG4vM0pGRW5udTRCdUovUHBRNTNQY1hLTTNWM041Uis2dkVHdHRteWtxRDZZCkp5NjZrQkxMdk1aLzZvUHJzZWxNUUVZZjRwa21CSnlHdHNxOElkR3RZT1dVdXpwbmhuTUdWRG8vODVrUVIvaEwKaUhxQW9TMEJXMDU1eEdsVzVFa2VGZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K kind: Secret metadata: name: client-tls-certificate namespace: envoy-gateway-system type: kubernetes.io/tls ---- -apiVersion: v1 data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFVENDQWZrQ0ZGZ1A5ckEyNFA2NnhXcDRQSnEzY05KdHJYRXBNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1FVXgKQ3pBSkJnTlZCQVlUQWtGVk1STXdFUVlEVlFRSURBcFRiMjFsTFZOMFlYUmxNU0V3SHdZRFZRUUtEQmhKYm5SbApjbTVsZENCWGFXUm5hWFJ6SUZCMGVTQk1kR1F3SGhjTk1qUXdOakF5TVRnMU5ESXlXaGNOTWpVd05qQXlNVGcxCk5ESXlXakJGTVFzd0NRWURWUVFHRXdKQlZURVRNQkVHQTFVRUNBd0tVMjl0WlMxVGRHRjBaVEVoTUI4R0ExVUUKQ2d3WVNXNTBaWEp1WlhRZ1YybGtaMmwwY3lCUWRIa2dUSFJrTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQwpBUThBTUlJQkNnS0NBUUVBblpYeHQ0Tk5TQVYxT2YyWDBDY1E2clk1eUlKQjRVWlkzVytPSlpQZmZtT0xZSFE5Cld6ZEQyUStCdHpocHNnVmhuZ25XZjVCeDlzbFExakdmSWY3eGFJbDNHcE13S3dsbk1mRlB6d0lxcTc1MHV4bzIKcU9QV1VwTHhoWXl4eVVHU0xXeTZuZ1RHOTBnRjM2MUNsWkJqVWxML2g3M2VHSmMydERVWG85T1k1SFhJc0hnbwp0WlJTWXdJV1kwbjgyMmFTT0tPTCtBeDc0eVV3ODMwSnRxK1RmbDlCbjFZMWNZVjgrNDZqVnhodzBVWHlac1diCk5CdllzQk1jZmFVcmdyWjlSVXYzYlJuNS9kUVFlanMvRzJVOGlmNW9qR0NaSG5nUEFLV0NyS0MxejU1RmVYbEgKSDR1cVJ5ZGRKL1IyYUVsYnkyeUhrSmVEaFRjQmhxUXFIT2dMU1FJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQQpBNElCQVFBTU1ldzg2dmVrM1hpdGNUd25lcnlNOUU0MjVCOVYrd24ya2swYTFNMDhlSGhNU2xHREQ4bG5mb1hKClNhZHEzbStBSlgyNHByZTBJQkMzRlhXajBrdCt5ZXN1dCtQR01jaHR1YXJYOU1PakpPRVk1NFFCRUdBNXJ0TzgKRWM0bWdqNkkzSGxGa2RTbUVkZTJjVTFPMDFlU3JZZG9vWUpmc2RLN1drUWEzNElRb1lPREhPbUFnMnluaVhZbQppSXZaUHkzUHdYSnN5VFNpYi9BMXQ3WEpoS3RIdUxvWGxPTHpVSUFMVkZsRzRNQjRreHcrMlVueFZHdjI0NUg0CjFsTnVaRk1BSXhWMXdZYkplbTFUT1ZLcFdMVmVqWE85SWZvcks1VmdqVzV2TkM1ejU3Um41dDljSGwxUHVhVmQKYk01U2ozU2pMWW52cXNQZ2JReXAxdWc3UEJBUwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2RsZkczZzAxSUJYVTUKL1pmUUp4RHF0am5JZ2tIaFJsamRiNDRsazk5K1k0dGdkRDFiTjBQWkQ0RzNPR215QldHZUNkWi9rSEgyeVZEVwpNWjhoL3ZGb2lYY2FrekFyQ1djeDhVL1BBaXFydm5TN0dqYW80OVpTa3ZHRmpMSEpRWkl0YkxxZUJNYjNTQVhmCnJVS1ZrR05TVXYrSHZkNFlsemEwTlJlajA1amtkY2l3ZUNpMWxGSmpBaFpqU2Z6YlpwSTRvNHY0REh2akpURHoKZlFtMnI1TitYMEdmVmpWeGhYejdqcU5YR0hEUlJmSm14WnMwRzlpd0V4eDlwU3VDdG4xRlMvZHRHZm45MUJCNgpPejhiWlR5Si9taU1ZSmtlZUE4QXBZS3NvTFhQbmtWNWVVY2ZpNnBISjEwbjlIWm9TVnZMYkllUWw0T0ZOd0dHCnBDb2M2QXRKQWdNQkFBRUNnZ0VBVVN0ejl4K2x4ZXd4eHE0TjdZVEIzUFFCN1hyU3JsUEs0RHhlenBKTmMwK1kKOGhUTnFkZGNsa2k3ZXdHT3g4aW4wSHlteE14Rk4yWFl3b3VLdVRzVlk5QXl6amgwZmlaNHhpdlMvUURUcytVRgpRWDZ1R3U1SWJmNE1jOHJWcEtHbXhza1RrdU5KRFFSSEtrQ1haR3ljREVKK0pwQXcveCtjYU5SVUdlbWEva215CklrZ0FRMUpxQ1lFNTJKUG1PWGRhL3VjMEJtMGYyQkFZUmh6V3JmRGV4SnlzelloMDdhNHNWVW9FRXlxbjlFV2EKbVZOQkV2SzQwVm1KVFcyV1ZuN3lZUnk2OUgvbGl2cGZWdG1RbE9SaVBkYXRaK1RUaXA2VHF2SFIwNHZyam1pMApQUXdhbkJmN3Z6aE9SU3Z1VDhOUEtWV1pkeHAxQm1JaWtrUmpSYjRyMFFLQmdRRE0yaWk5QXowZDVSbnZzV24zClJrWlNZbG1CaHhROGFKajBqY1l0cHBycEQ3ZFgvbGh4dDRHNFBSVWx5QTcwSmFMOVBrTVhZcklhNlpJMUQyRC8Kb2ZSbFoybE9HMUtnVVVTUW42bFFiaWo3NkdyaFhlOXhvRDE5eEdEai9HWTFSRDB1VGI5OWhtU1lyVzJySnREQwpMWG0vWUV1TjJGc2N4Q3QzOHhBVWl1bzZiUUtCZ1FERTdwV1laa3RzeXcyTkJhRmo1NXZJYkcyVjhkUk9vdzFsCnY4cWxsMllHWXpHWEJzNlBodzlGMUNzcjl4dm9HNmhPR1hFNmxOL25RZGtxTEtONEJqM25lNXZJMGUxKzI0TG0Ka0lZK0ltTWo1U2w4QzFuUzR3MVFVTlREYWIyakhackFXd0hJQlBUdFYzbDdMY3cvQXh5NnRjcVJ2alpoQjVnZAplL1N3RStzS3pRS0JnQm5wbHJHaUVUOFExZUVPRGh0clZrWGhqdlRsZzFmSTIyQkQ5c2ViaFlqcHBnV0pkT0tkCmxka2FVT3lBaS9PeU54WFZwR0wyNXhTa2F3d3ZMOVBtUnFYMUdNcjZoYzhsdUlpYXlhNFU0VFpNUmdqUCt4UGkKY3lUUGpIb0tXVnR2a0ZXbEhBM2l6Q0xML1UxakVaRWVjNElUeWpyZEhWbGNMeXR6SVp1WG50MVpBb0dBQUxsago0WENXM0dxT3ZUTUZHZW56SDdTT1hwdktEUlA2YTZKZDYyZjRIeFBrVGNyZm5aV0FqK0FzM0hlSEtiNVlTeGs2CjJsMUx5WHpyZ0lVemdMQjlMOG03ayt4NXRCcTRpNEtDaTkzeWdXSkpXY1JzNnlLY25Pdi9MRXpLUHJ4UUlsN3oKVGJuKzhKUit4TjR4UHhZUzEvanRLc1lKU3lnTS9pYkRpcFk0S2cwQ2dZQmExL0RYQlVIVWI3UlFWcVBrdVJsYQpHenhVeTd4c3dXQkNVbWtkNkdyUG4vM0pGRW5udTRCdUovUHBRNTNQY1hLTTNWM041Uis2dkVHdHRteWtxRDZZCkp5NjZrQkxMdk1aLzZvUHJzZWxNUUVZZjRwa21CSnlHdHNxOElkR3RZT1dVdXpwbmhuTUdWRG8vODVrUVIvaEwKaUhxQW9TMEJXMDU1eEdsVzVFa2VGZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K -kind: Secret -metadata: - name: client-tls-validation - namespace: gateway-conformance-infra -type: kubernetes.io/tls + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMwakNDQWJvQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0xURVZNQk1HQTFVRUNnd01aWGhoYlhCc1pTQkoKYm1NdU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVEFnRncweU5UQTFNVE13TlRReE1ERmFHQTh5TVRJMQpNRFF4T1RBMU5ERXdNVm93THpFT01Bd0dBMVVFQXd3RlpXNTJiM2t4SFRBYkJnTlZCQW9NRkdWNFlXMXdiR1VnCmIzSm5ZVzVwZW1GMGFXOXVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWxBWGYKTFVOZS9jbEQ2VjA1MVNZTm5XWW82aU44T1cyOTZnTm1JeHF5Y0J0TFp0ZTBzdlJJVXZQclczUkErb0ZCRjFocgpTeWZGZGJ5Tk0yQjB3WFhFRTlRVTg0c1RZdk9wNkk4TjkxUlBHY2ZscVF1NEgrK040bGxHK1hOWDljMjk4ckJxCkVWaitQdmMyWW5WZ0JLUi94bVczTUJpZVhEOUVxaFBsc2Y3Z0d6MjBKYVlqWDZyZ2tUdVVnSTBKcEhLNTBwaDYKU1BwazFaSERoTzk1RUUySVFQYk5GTFNwam1YeEFSMkdxOTYrVzcySWlsaVFyRk13M0IxWVBrZ2loeVpGZUhKTAo5THg4SllicmdEQjZjcUFxL0lIazRBRmd6engrdDhVNDFZYkRHUlZRZ25sVDlYVXE1Zkh2aEtzVDB0cWY2U0diCkg2eGlhbnRpcnphVktnYi9EUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQm1TY05IN3J5ZUFlNksKeU5WcWc2UlUrOFNoWTFnTTlCQTlUZTBLVmtEd0MyMVZhYkh0bjJiQm5MOHZlZzY2Ny9QUWZhbEhrR2tGMG94ago5SVRQb0tBTEt5dHV1VlFJRWtTVmxKOHhjZnplUHBzbGJEeXZ1R2Z2dGtkV0ZxbElsam9PSUU0SndSNjkxK3B1CjB3YnVzaGkyZHc4OVFmSXRGOFBsbVM5ZjZLSFVsTGtRdGV3c1hUSDVJZWo1dmxsOVV3ZEFjWWNQM096bXM0VlAKVjFtOW1tNjM1aDJJSDczajVkSmhyUzRTbmRRUVJqeGczN282Z1JLYXU3bi92alRZbmFhR01xTkgvMkc1cGtJSQpzVmViejM2SHZsNDluaU83Vmd4R3BXa1VyaU43Mno4OFpsK3J2T2dCSGIwTlFvQmhuNWt2TU1JL2svZVNRL2dDCnpVNmoydmZCCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ1VCZDh0UTE3OXlVUHAKWFRuVkpnMmRaaWpxSTN3NWJiM3FBMllqR3JKd0cwdG0xN1N5OUVoUzgrdGJkRUQ2Z1VFWFdHdExKOFYxdkkwegpZSFRCZGNRVDFCVHppeE5pODZub2p3MzNWRThaeCtXcEM3Z2Y3NDNpV1ViNWMxZjF6YjN5c0dvUldQNCs5elppCmRXQUVwSC9HWmJjd0dKNWNQMFNxRStXeC91QWJQYlFscGlOZnF1Q1JPNVNBalFta2NyblNtSHBJK21UVmtjT0UKNzNrUVRZaEE5czBVdEttT1pmRUJIWWFyM3I1YnZZaUtXSkNzVXpEY0hWZytTQ0tISmtWNGNrdjB2SHdsaHV1QQpNSHB5b0NyOGdlVGdBV0RQUEg2M3hUalZoc01aRlZDQ2VWUDFkU3JsOGUrRXF4UFMycC9wSVpzZnJHSnFlMkt2Ck5wVXFCdjhOQWdNQkFBRUNnZ0VBRlhTRmJRYmhINmw2MDdvOHpmbWlTeEI1K1RnVUF6SDJMMU4zVERyTUp1WTUKNTJuNEtlRXhFMzhCL0FOTmdOSFgyTFdxOVoySjZEOGdlMVF0a0RZTTZlL1phcFNieG9HNWZMa3hoY285WGVnRQowSndmZjllRjZndFZONGFCdHlIdmVKd2IvN0ExeC9RbXVKNDVRT3NFRDBLQ2l6RGlVVTRsV242Z1VreTJlSlFnClNoTGNkVjZobWFHVGhyUzNUTWlSMnlqK3F4UlhpSEdvSXdXN1BkM3V4bEZiMVJ1bW9JMGhUN3dEVWNSSk52K0cKemVlNUMwODk4UUlyeGxqME93amM4dGVMaDFJQXplTFNWazk3dEluaFVTRFlrSnNBcFhTYVNCam1pa2VCbzlJWAoyRlJQN1dxeTFQRjkvTCtzOTNSMTJycDJmOGh2ZGFXM0c2NHl4dnBLTVFLQmdRRExkd2NWYXQzUEtoNWU2d3VOCm1kVGFoN29LTHI2RUZxZ0tGNlRkcnV3bmlPbjQzQ0tQekgxK2tIdElKYXQyM3R4VzJUeVZqTkExY1REaUZnS00KK1MyWFdFTDBmU0x3VmVOaSt2MWdaYlFKZVQyMUt0cmVBb1VTZzZLU2NxZlFaam5BVXFrZ0xaUGJqZnQwZ0NWUAoyZ2Q0UXpyT05NQnlDdm5vd1JnNXc5T1lFUUtCZ1FDNlBpUytUUUVidDZYZHIvYXpncUlQSXBWYkFYbEpPbDBQCkt5eWxQY01OYkw0dCtHNXROdStjMEtIeVExbG9FMWg5eXRUMCtKTk16R1BtbkQ0b1VtUHBwUmZnL256bTlzbEsKVGNobXk1bnJLenMvVlRqTmlDRkxTdjJIc1ZBWkFWcnk4N2ZwOGt1VUhXbTlHUnVJRXIwZGhmK1BtQjFGTEpZegpSekxZdGFxVFBRS0JnUUNIMk9BTTU3NVRMRzc4dHZpT3diQUJmRysxanNJN1ZSazdLOUF6QnpDN3NNbHZGQ09yCldVQk0rZENtT2lpQ2hJZ2ZJSW8zMjczRWdOKy9oQ3lOelcwb1NKRGp4bzFHWkVJZSt5K2paaVJQMHZobGRzaU4KUktkdTFoNzhvcnJ6Qk4zNFQvaUYrSWhwSmlKSEJheGo1VkhwZFJIVlRobFR5NHBTWW1KM1p3MW0wUUtCZ0JGUQpwNy9kanVYUnpDVHhNQ0YrV3F6SGpWVTVyTm9IQ0JIWjlMdWtJMWRETGVjK09wNEN4b0l3ejIyam4xTlN3UjVvCjFpVzBXcFdBUnlWd2owTFdiaDJSME1lRlFYMkRvakU3VEE5cWpIUFZ3QnRpUS9hdjJsQ1N0MEYvVmJBTmRUUXoKUG4wTW5zUTFlOWd0MW1adlA0L1lIbXR1UEFKclk4ZCtyaGFCeFVzTkFvR0FiTXo4VnFpend5Si9rVlFQTUx5dQpJaHpyMThxUEIzcXp5QVVDOHJBMDNDcnM0L01mTTloOFB3TXdkRVdKb3JMQ1ZwRFhqbGVqZXE2Z3pPMmpCdWJDCldtYmxSaFUxN0NQQUJpY2dFR2hIVitFNnlzbk8zbnZ4Wi9uT2srUTcyRGdkZkFJQzc1UHdMbFF2NDVnbnI2Y3MKdWQ5TXVEOGtrZDVpQ3VHbTNrRGpZY009Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K diff --git a/test/e2e/testdata/backend-tls-settings.yaml b/test/e2e/testdata/backend-tls-settings.yaml index b78ace739f..2bcb291a28 100644 --- a/test/e2e/testdata/backend-tls-settings.yaml +++ b/test/e2e/testdata/backend-tls-settings.yaml @@ -6,52 +6,73 @@ metadata: spec: gatewayClassName: "{GATEWAY_CLASS_NAME}" listeners: - - name: https + - name: http + port: 80 + protocol: HTTP +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-with-backend-tls + namespace: gateway-conformance-infra +spec: + parentRefs: + - name: backend-namespaces + rules: + - matches: + - path: + type: PathPrefix + value: /backend-tls + backendRefs: + - name: tls-backend port: 443 - protocol: HTTPS - tls: - certificateRefs: - - group: "" - kind: Secret - name: backend-tls-certificate - mode: Terminate - - name: http - port: 80 - protocol: HTTP - allowedRoutes: - namespaces: - from: Selector - selector: - matchLabels: - gateway-conformance: backend --- +# openssl req -x509 -sha256 -nodes -days 36500 -newkey rsa:2048 -subj '/O=example Inc./CN=example.com' -keyout ca.key -out ca.crt apiVersion: v1 +kind: ConfigMap +metadata: + name: ca-certificate + namespace: gateway-conformance-infra data: ca.crt: | -----BEGIN CERTIFICATE----- - MIIDQzCCAiugAwIBAgIBATANBgkqhkiG9w0BAQsFADBCMRMwEQYDVQQKEwpFbnZv - eVByb3h5MRAwDgYDVQQLEwdHYXRld2F5MRkwFwYDVQQDExBFbnZveSBHYXRld2F5 - IENBMCAXDTI0MDMxMDE1MzIxN1oYDzIxMjQwMzEwMTYzMjE3WjBCMRMwEQYDVQQK - EwpFbnZveVByb3h5MRAwDgYDVQQLEwdHYXRld2F5MRkwFwYDVQQDExBFbnZveSBH - YXRld2F5IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7ZFmGB4e - m1KdGEohAZBfqydAEGLDHJ1YyfHWdd+vBAevdW64bZx3pggJOtgCnePuFd02rDQS - dlsJlX/6mFtoQilo6wvxDSJRfaTDbtfTjw+7k8yfd/Jsmh0RWG+UeyI7Na9sXAz7 - b57mpxsCoNowzeK5ETiOGGNWPcjENJkSnBarz5muN00xIZWBU+yN5PLJNxZvxpZJ - Ol/SSI8sno0e0PxAmp3fe7QaXiZj/TAGJPGuTJkUxrHqyZGJtYUxsS8A0dT1zBjj - izA5Dp+b5yzYo23Hh7BgpbZ7X4gsDThFuwCD6fHyepuv2zHPqvSsdqg2hAhDp91R - zrn7a9GxG2VSIwIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUw - AwEB/zAdBgNVHQ4EFgQUUpP1aZ1M2KIuPPWrNPDV2c5CngowDQYJKoZIhvcNAQEL - BQADggEBAGSEkAVz+Z0qS4FmA0q4SCpIIq64bsdEjiUzev7pK1LEK0/Y28QBPixV - cUXfax18VPR9pls1JgXto9qY+C0hnRZic6611QTJlWK1p6dinQ/eDdYCBC+nv5xx - ssASwmplIxMvj3S1qF6dr7sMI2ZVD5HElTWdO19UBLyhiKKZW2KxDsYj+5NRwGFe - G+JuDgq7njUM8mdyYk0NehefdBUEUUCQtnwUtW95/429XwqQROuRDteGT9kjD+Y5 - ea5mW4mfqLeuGJXZs9bdWjKKdLQPrn9IshPysWqz2Hz8dQ1f7N9/g8UWVSjd4cyx - S5EAolzVv0yB7wHCWCgfG/ckdOTUNnE= + MIIDPTCCAiWgAwIBAgIUCPaRrg+0wCmznOMf9HxtYXPc+rowDQYJKoZIhvcNAQEL + BQAwLTEVMBMGA1UECgwMZXhhbXBsZSBJbmMuMRQwEgYDVQQDDAtleGFtcGxlLmNv + bTAgFw0yNTA1MTMwMTI0MDRaGA8yMTI1MDQxOTAxMjQwNFowLTEVMBMGA1UECgwM + ZXhhbXBsZSBJbmMuMRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcN + AQEBBQADggEPADCCAQoCggEBAO7E7Gtx+tUS5UujhJ/DdSqsqQQ391WnrQbI1i9c + tiYSj8p8/eq1dAw4u3gG5426UaVph8LG5GLYCGT8XPmeWQMZncGvf9TeqlmBz/WM + NJ6Ow7dh6pWfGuZ7FHkv+l7L7pd/SFd8z0yuLBeTkE3weZ0jcnoThpm7Unu5ULdV + /ZE0rnAG7cjqiTALj/QE1gF0VkXw6D9fT5SamKYasYT0ZQND5tVOlLoqXjYU1fJF + Gyqs7hI24c6KeB1G6giWvwiUSzHBmCL0seCDDGeIjhtO7YubRZqNHaE1cw3FFlb7 + FwXbff8XVb85Mxy6Jwdq27sCy4iMUSBVgbRhLRb9Cp+iUBMCAwEAAaNTMFEwHQYD + VR0OBBYEFAhZJV5u/3sXGacaUkuP5zIFZYGiMB8GA1UdIwQYMBaAFAhZJV5u/3sX + GacaUkuP5zIFZYGiMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB + AJJmuyGwjP9KG1uwhfJ5jq3b+vUUZW29HnFzEfd50GAk++W1WBTyxpWXCX0VW4Va + /QcJJiROXoKUqGtqPHYKx8UQ/mzrmlRGMgKwYReoMLU6ukydox9AUDVQFnOQZm26 + QTCwXb288715UeK+c+TdmpkFkTPh3F67HDn0q9mtoT9g9BckJRxoHaez1LfxbytW + nNBx3Rpk1Ps79EfjtKL1BJIvG/N/ar9Jey2CR+tlVKwrrPCGG1ObcGvHooQWOOCq + 7jD99R8PXZV5VDyP8qoHPYYyqkaQH4nQtVm288vFNQRF+/vUUQsNKl/JQcTG2UCc + IwP0azf9fJ+Xxx19TOMO3FA= -----END CERTIFICATE----- -kind: ConfigMap +--- +apiVersion: gateway.networking.k8s.io/v1alpha3 +kind: BackendTLSPolicy metadata: - name: backend-tls-certificate + name: policy-btls namespace: gateway-conformance-infra +spec: + targetRefs: + - group: "" + kind: Service + name: tls-backend + sectionName: https + validation: + caCertificateRefs: + - name: ca-certificate + group: "" + kind: ConfigMap + hostname: example.com --- apiVersion: v1 kind: Service @@ -62,10 +83,10 @@ spec: selector: app: tls-backend ports: - - name: https - protocol: TCP - port: 443 - targetPort: 8443 + - name: https + protocol: TCP + port: 443 + targetPort: 8443 --- apiVersion: apps/v1 kind: Deployment @@ -85,100 +106,80 @@ spec: app: tls-backend spec: containers: - - name: tls-backend - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e - volumeMounts: - - name: secret-volume - mountPath: /etc/secret-volume - - name: client-certs-volume - mountPath: /etc/client-certs - env: - - name: TLS_CLIENT_CACERTS - value: /etc/client-certs/crt - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: SERVICE_NAME - value: tls-backend - - name: TLS_SERVER_CERT - value: /etc/secret-volume/crt - - name: TLS_SERVER_PRIVKEY - value: /etc/secret-volume/key - resources: - requests: - cpu: 10m - volumes: - - name: client-certs-volume - secret: - secretName: client-tls-validation - items: - - key: tls.crt - path: crt + - name: tls-backend + image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e + volumeMounts: - name: secret-volume - secret: - secretName: backend-tls-certificate - items: - - key: tls.crt - path: crt - - key: tls.key - path: key ---- -apiVersion: gateway.networking.k8s.io/v1alpha3 -kind: BackendTLSPolicy -metadata: - name: policy-btls - namespace: gateway-conformance-infra -spec: - targetRefs: - - group: "" - kind: Service - name: tls-backend - sectionName: https - validation: - caCertificateRefs: - - name: backend-tls-certificate - group: "" - kind: ConfigMap - hostname: example.com ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: http-with-backend-tls - namespace: gateway-conformance-infra -spec: - parentRefs: - - name: backend-namespaces - rules: - - matches: - - path: - type: PathPrefix - value: /backend-tls - backendRefs: - - name: tls-backend - port: 443 + mountPath: /etc/secret-volume + - name: client-ca-volume + mountPath: /etc/client-ca + env: + - name: TLS_CLIENT_CACERTS + value: /etc/client-ca/ca.crt + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SERVICE_NAME + value: tls-backend + - name: TLS_SERVER_CERT + value: /etc/secret-volume/crt + - name: TLS_SERVER_PRIVKEY + value: /etc/secret-volume/key + resources: + requests: + cpu: 10m + volumes: + - name: client-ca-volume + configMap: + name: ca-certificate + - name: secret-volume + secret: + secretName: backend-tls-certificate-tls-settings + items: + - key: tls.crt + path: crt + - key: tls.key + path: key --- +# This is used as the client certificate for the envoy to connect to the backend service +# openssl req -out envoy.csr -newkey rsa:2048 -nodes -keyout envoy.key -subj "/CN=envoy/O=example organization" +# openssl x509 -req -days 36500 -CA ca.crt -CAkey ca.key -set_serial 0 -in envoy.csr -out envoy.crt apiVersion: v1 -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURPVENDQWlHZ0F3SUJBZ0lVUWNxbnZtQXlkRUtuOEdqWTdjZzVDb3A2QWp3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd1JURUxNQWtHQTFVRUJoTUNRVlV4RXpBUkJnTlZCQWdNQ2xOdmJXVXRVM1JoZEdVeElUQWZCZ05WQkFvTQpHRWx1ZEdWeWJtVjBJRmRwWkdkcGRITWdVSFI1SUV4MFpEQWVGdzB5TkRBMU1USXhOakF3TlROYUZ3MHlOVEExCk1USXhOakF3TlROYU1FVXhDekFKQmdOVkJBWVRBa0ZWTVJNd0VRWURWUVFJREFwVGIyMWxMVk4wWVhSbE1TRXcKSHdZRFZRUUtEQmhKYm5SbGNtNWxkQ0JYYVdSbmFYUnpJRkIwZVNCTWRHUXdnZ0VpTUEwR0NTcUdTSWIzRFFFQgpBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ2kzUis1WGx3SnlYSTNidTRVQ3E0NXgwSkdWQVBTVXRFTFlLUkxpOEo2CnlxOStySE1hVUtubDhsdldLaHlCNDk4WkJBdVVGS0RpcGhkS1A2eU0rRGl1azVIa2UrK0NmeGxkUDFiSGZiNlkKSGFWczh2cFMyUThneUF6NEZqc3NnNThMV1NKWTdEeEhSOWJibUVWelhSUjNWOEtDeDVaYVlkZ3RxU0NZTGJMTwozaGtGRGQramZxSzM3RHdiT253d21OQ2R0QmpRSTF1TmF2dm1QZzB0c3pwd29TQUtPRitPR0pHcTZHcDdNY0NtClFHZ3dYNkV0YzMwd3hJQTd6c3RnTWwzT293a3p4NHNMcFdJamdCSDVlVk9oYnB6NXROLzB2VFZ3Z3hlbTlOVisKQURjSTFBcnY5M1ZsaFB6VEFmZUNDUlljeFFiNlp4dnBuMWlRbVIrZkVpT0JBZ01CQUFHaklUQWZNQjBHQTFVZApEZ1FXQkJTMGRnRHNtQ3AyU0pZVzNPa3pkNDZtbFNndHZ6QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFab0NCCnE0M2taV1RZT21QR3JYMU5RMllIVTQ2Y0pzRGxsN2JFL0ZIRUo1eEJEcWRGaUdhWkZBcGRkK3Mra2tkUUw5NUUKcU1SVk9nYS83TUFIL042dlRmb2tXcnVKUUFqaStpLzhGSllWb1VZTWMyeUxqYXp3ZS9ZMHlzTDRWRTNGUlZybApmVHRCTC9nVkhjNk9ZOFBpVFh4eitqdy9FN2kxQkRxZkdSK29sYmt4ZkVmWnhHN0tEZUVtQnVva0dxbDlYQXhSCjMzbnhSbFZuODdxSnJrdUlzdWl2ZzczaVVNMVpGUE1CRVp0OEJjU05MaWhxZEx0b29FVy9mcGZ1am9oaC9yTjUKOFA1ajJpWm9KOGpBS0t4YW5SaWhXTklSNzJtYnJ1R2hYOFRIQkxzczFvZlpLdHBXMzlUOTBTM2hnWkFwSmNZYQp2aGVwSnRtbm9jcHNnYUJiL0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2kzUis1WGx3SnlYSTMKYnU0VUNxNDV4MEpHVkFQU1V0RUxZS1JMaThKNnlxOStySE1hVUtubDhsdldLaHlCNDk4WkJBdVVGS0RpcGhkSwpQNnlNK0RpdWs1SGtlKytDZnhsZFAxYkhmYjZZSGFWczh2cFMyUThneUF6NEZqc3NnNThMV1NKWTdEeEhSOWJiCm1FVnpYUlIzVjhLQ3g1WmFZZGd0cVNDWUxiTE8zaGtGRGQramZxSzM3RHdiT253d21OQ2R0QmpRSTF1TmF2dm0KUGcwdHN6cHdvU0FLT0YrT0dKR3E2R3A3TWNDbVFHZ3dYNkV0YzMwd3hJQTd6c3RnTWwzT293a3p4NHNMcFdJagpnQkg1ZVZPaGJwejV0Ti8wdlRWd2d4ZW05TlYrQURjSTFBcnY5M1ZsaFB6VEFmZUNDUlljeFFiNlp4dnBuMWlRCm1SK2ZFaU9CQWdNQkFBRUNnZ0VBQkZlOUxUbXNMb3VBWGZTWmdRZStnT0pZbU1pTDZpcG91aWI0Wlk1dFUvM3kKYVZoRXlOVHhuVlRadkoyT2lWc0JzWVNLWUo5TzBaRmFSOUhJSnBHR1BTYzRvOGNYWGpkb2RqUmFrbjdtbDQ2NwprT3JQR0lsQ3ZFb0NVTVdTdkExNXpzMGdmNTZUdmthMjFxL2VHdmtPZ3c3SVBEbVJSNEZpT05nNGt3ODlwRU1FClhNMVROK1NZSGR1eU50RG1wSy90bjFFcUxtOUJUVy9XSk8rMHhLaG1EVStDZnN6Y2hmcS82QitQSVNteEhXUTUKV2JVL3BBNVlvRlM3TWZYbjhMcXVuSG55RGcvNERaQ2NXQkpZZTdZNWtqczVVd2c2MnJBanZxTUZPaWk2ZEgvWgpSQWFWbzlUeEEwZVB4TkZIY2w5M2xuQzRvSGpFV0pvajIzOUdTb3pMWVFLQmdRRGJaNDhNOUpNdkJ2Q2JvSWlXCi9jc3U2ZFRNNmlRTzd3dVJEekhETlpGN0pxWmxOVUhkMU1hZXVYOGhYaE1YeWZpN2FFcGhKMGFZOXNwZ29SdWYKamIyeWVhb3JBbnlOL1VIZ2NjdG5ESWdheEJ0K1JVREZUeE1uTnhrRUVnTnF5WDJCZllOdlNyMmxOVm9PbGhUWQo4VzV6UGJyekNDbUgzSXd6bkhmcW54QVZJUUtCZ1FDK0IwOEVpRERZd1ZKRU9uNyt3eDZyZWlQQklmanBFNUNICjM4ekpYVVBUaWRLZWpORnU4aUlGZmkrdzEvY0VBTTJXcE1xVEtnM2RCSTlzUGZnWXZFSUlvMW5adUFNVnhaY04Kb0k2QXdUckdWMldHSjdQNlNNbjhyWTJhUGRQcDl1ZXE2MFEwZ2p2NVQ1eUliekdPaElmeUpxSXJHYlFvbGdkagp3cXg4K2ZQaVlRS0JnRWJSdklqd0FQb3pBVU1hcER3b200Yi9EeU05aUhvUml1Zzl3VkJEWUR3aUU1K2pleWxCClh3TW8yUEpLVFZ0bVpCVUo2c2hGUnpKa3BwcGVKbTV2OEFWRjVEbVJ5ZWFERXRxQm9LZ1lrVzRpVXNXRlVRemYKSTAyTEtWWDVBb1ZibUZsTnpEa0dKUVRJbmRNTGVwczBBdlRMdmlab1FnK0tqdTZ4Mkxzd3NKNUJBb0dCQUxFcApDUzcxZFd5dkZ1NUxCdGltdWpJdDVhV0o4WkFDVUcyTVpWU1o0Y0VXcmNocENsdi8yMTM1bmFhbVFVRjNLalEyCm9ER0JOSG1JWmRvSkVBS25pSHliSmdwSGRvRFd2SlBVeXVZWXY1M29IdHRxcW0wOWJTcG45eXNFVjB1NWg1UWUKVUhFUHRiQWgyNUtLNzgycG0wQlRhajc2Y0s2aDZIUEdLNTg4UEhZaEFvR0FILzJMS044WnJ3c1R6Nmx6T2c3ZApzdUFuaDVFTUp0TEhTSDJHeFJ5aFcrYVFHdGNxdDZYK1dkNDZnd1BMQjRjd2QzL01nQkFvcFhGazhYV3pTVUlhCnI5SG9SQzZJT2tzQ0lOallCd2h2TjArcm5oN3JzTm5XZVd5Z2tWQ2tERDN5NlNTa2RTZjliOUZzWUJtOHY0VkcKYzFqdmVjWVF6S243QzFRU2FtUnAzRUk9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K kind: Secret metadata: - name: client-tls-validation - namespace: gateway-conformance-infra + name: client-tls-certificate + namespace: envoy-gateway-system type: kubernetes.io/tls +data: + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMwakNDQWJvQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0xURVZNQk1HQTFVRUNnd01aWGhoYlhCc1pTQkoKYm1NdU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVEFnRncweU5UQTFNVE13TWpVMU1EUmFHQTh5TVRJMQpNRFF4T1RBeU5UVXdORm93THpFT01Bd0dBMVVFQXd3RlpXNTJiM2t4SFRBYkJnTlZCQW9NRkdWNFlXMXdiR1VnCmIzSm5ZVzVwZW1GMGFXOXVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWlIS3EKU016TkpkM2lCbTg3MzB1OFQ0R25wK2FMaG1rYWFvSHAwMXB6YWJJVitxRUlnREJZUFNLemtsQnk2UVRYcDZ2Zwp4UXIvbDNEdGRqQWFEOEpoNVRRU2syNnRlbnJVWkhyTHFlTTl1VGtZR29jMmF1Nlk4V0tHbCt5QTBKUHNET3VKCjZNRlpZUy82Q2oveDJ0RkZEdFloVjR3cmJXQzUxVU1mY05iYzFoNHozSndGUlpLZi9BdkdDa1c2NkUvZFFDeXEKalRvMEs0SDRqNjZncWJXdGRLY1ZGOTUySUtwYkZwRmh4WmM3VWRJbGNUK1FyVUNCaHFVLzRKNmJXODg1TEZBSwpmWnpLbzBFckl0RFJ3WGNKZU0xSVUrTGs5bkJnUjZYTTVOOHEvVTluVHQ3MGFFR25sVWJSWHhyNmsvVWF1QjdBClRqbXJsVnZBOFVVU1BZbXpVUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQTZyNkd2WVF5NHEwRksKWWlqdkR6bTlOS1JaWlY1ajU0WEEwcWFwRGhUQ3loYzFueGQ5cTRLamNZQmhPRzhBczBkWi9SNTg1bzRnZDhpZQpDUmhQSWJ2cEJMZnc3MWFxOVIxSHBIOW9JRlBLN1VnemhpTnQyL0tVWkdURTVGZkRFNFhJa2E3ckVjT0RzMlNKClFxMnkwMmRXTmxLSDZ1cThLTi9zenBYR1RnRUkxT09BYSs2SW11QkF0SVJRY3Jra2JJcyt4eUxWMWlGNnNZZXQKTFdMMnA1MUdOanBiZFdaOXBrZWdvd1JJSXBEWmhDbFVPZHlMREFuQjQ3dE8vNGRTVGxZdndvSUs0UGN3RGxQRQpkUzdqZDI3Y0FzZ0ttb2NyMDhIOHVGUUZaK1VCWmN3YU5qL0lNODhjS0QxWHJIY2F3SXRsc0dKVHlxZkNhUmFPCjNPc0ZSUWNFCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ0ljcXBJek0wbDNlSUcKYnp2ZlM3eFBnYWVuNW91R2FScHFnZW5UV25OcHNoWDZvUWlBTUZnOUlyT1NVSExwQk5lbnErREZDditYY08xMgpNQm9Qd21IbE5CS1RicTE2ZXRSa2VzdXA0ejI1T1JnYWh6WnE3cGp4WW9hWDdJRFFrK3dNNjRub3dWbGhML29LClAvSGEwVVVPMWlGWGpDdHRZTG5WUXg5dzF0eldIalBjbkFWRmtwLzhDOFlLUmJyb1Q5MUFMS3FOT2pRcmdmaVAKcnFDcHRhMTBweFVYM25ZZ3Fsc1drV0hGbHp0UjBpVnhQNUN0UUlHR3BUL2ducHRienprc1VBcDluTXFqUVNzaQowTkhCZHdsNHpVaFQ0dVQyY0dCSHBjemszeXI5VDJkTzN2Um9RYWVWUnRGZkd2cVQ5UnE0SHNCT09hdVZXOER4ClJSSTlpYk5SQWdNQkFBRUNnZ0VBUDBNMnUya2xKb3pnK2szQmF5N1FvT1pDeHVCbnlVcGF3bzM0VFJOdlZrNkkKelRxelY4ZlNhWW40eXZvOHhOZ0hhc2lRZnBzeVZOTTViZVl3ZHlVUFFYY3FzNnVKaURPQjNSSm44aDBYWlpUWQpuWmdhUFdyaGcyMUViUlRzeG9nRzFoaXd5TGM0aXd4MCtDS2NybkQvZlRqL25Ya3lPMVN3NUhWcUV1V3ozeHZWCmE0WW1TdTJnRkNQZlZDemhQT1IwbGc5ZFRYZmlWQzEvTHpXRXllbEVpMExtMm90cFJaUXVUd1ZzekVuLzNjQTEKamlKREJEWVEvS1ZESTJ2QW9OK25rRWozMTMwVHFaaUphNlQrYTkreEdqMHpyQzNXdU9yU0oyVml2N1JwSytMWgpveGxpazBkNkU5Q3lIa2JXWTRPQlM3UEt2c1hqRHpFY3Vuc29SRngzMXdLQmdRQzgwSTV0YkNFV0VqaHRSdmdPCldVUkJ1OFNPek9qT2hGc0Y1ekNjMEJzWlVHak1pUm1KYUFLa2t2MHhvOVVmK05DU2NQWVJpTFJoZkoyRUZuM2wKR2dYOFJrdGZKMTRFd2d0d0ZJd1pzSkhuOEczdXJPcjJRd3JCcTNCb0dGb3NyR091L0V5Wk5UYmF4VUZrZVhBbQp1TysvZmpaSFVnZXFQSVdvR0ZUclk0SzhCd0tCZ1FDNC8rN2NLLzQ0Y3ZwTHpPK0xzY25vc2VnY2xqUWpkZm41CjNDQzNQL2E0UjlveFR5VWorejlPWXdiUkhMTmYwTzJQNWRhUGdTV0pIV2owM0FUemJ6L2xxVi9Td2hkTTNFejAKU2pqU2Z4NktKS2VyK0dyeXQ2V2tIa3k5QjVwcVN5UVlueDBBZ0lvdURuY3NQazI2cUV4Mkdzb1RURlowR3EvMQpHbStBeDkxdjV3S0JnUUNzL2ZRUWd3cEpXNFpCY00xaThCeWVrVGVFa204V2o2T0o1QWpoRTdaUVdpQzZqVDVOCmEzTkliN2YxSENMdmVSczNvTEdDM1JwUFcwcENOQTFDczdZYUxobHVZL1k3SzhJby9WcGpTeWhUTmpDeWhkRjgKc1c0UWhVK212L0VXanhlQnduMDN2YzYxWUJjS3hFeWgzYjBqV0xMSVkzck1XVWtuK3FzTFE1QUxUd0tCZ0RHdgpRclpNOW1Td3RIb2hHd0NZaWhKOW5VbjRLUjZRODhiZ0VNVkdYM3VVaUl3UHBuam9aRk1vRTArYjlxeTREdVZECnBBRThmUms3RmRJVk9Sc3IrS3cwZGZERGdjQjV0ZzB4MWRycW13Z2MyZzg4azNTR1QrMG8yaEUyZG9rdmp3MHgKeG5jNURtTmFMVFZyc2pKOE9yVEpjeFlGdlg1SElKU2lPZW9MUTNSbkFvR0JBTEpuejJja3dZVXM5UHFVNjd4TgpRc21UM25ON2g5SEZ2WVJTR2xJUWROT2l3SlpiMWRZUHM2QzFlYUF1U09iWHNEWkRsNmtBVXZ3U1JHRTRKa2ZnCmpBQ2h5QVRKV3NJTVNMbkY1SHlJeE1GQVZwa3d1QW93RlIrdCt2NXppakxJZ2RPWnhhaG9BNjdENVcvb3hsMlAKMWRSdDVuaS8zTGNRaEdpMmtDWG9vK2JnCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K --- +# cat > openssl.conf <