public interface CertificateValidationContextOrBuilder
extends com.google.protobuf.MessageOrBuilder
| Modifier and Type | Method and Description |
|---|---|
boolean |
getAllowExpiredCertificate()
If specified, Envoy will not reject expired certificates.
|
DataSource |
getCrl()
An optional `certificate revocation list
<https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
(in PEM format).
|
DataSourceOrBuilder |
getCrlOrBuilder()
An optional `certificate revocation list
<https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
(in PEM format).
|
StringMatcher |
getMatchSubjectAltNames(int index)
An optional list of Subject Alternative name matchers.
|
int |
getMatchSubjectAltNamesCount()
An optional list of Subject Alternative name matchers.
|
List<StringMatcher> |
getMatchSubjectAltNamesList()
An optional list of Subject Alternative name matchers.
|
StringMatcherOrBuilder |
getMatchSubjectAltNamesOrBuilder(int index)
An optional list of Subject Alternative name matchers.
|
List<? extends StringMatcherOrBuilder> |
getMatchSubjectAltNamesOrBuilderList()
An optional list of Subject Alternative name matchers.
|
com.google.protobuf.BoolValue |
getRequireOcspStaple()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
|
com.google.protobuf.BoolValueOrBuilder |
getRequireOcspStapleOrBuilder()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
|
com.google.protobuf.BoolValue |
getRequireSignedCertificateTimestamp()
[#not-implemented-hide:] Must present signed certificate time-stamp.
|
com.google.protobuf.BoolValueOrBuilder |
getRequireSignedCertificateTimestampOrBuilder()
[#not-implemented-hide:] Must present signed certificate time-stamp.
|
CertificateValidationContext.TrustChainVerification |
getTrustChainVerification()
Certificate trust chain verification mode.
|
int |
getTrustChainVerificationValue()
Certificate trust chain verification mode.
|
DataSource |
getTrustedCa()
TLS certificate data containing certificate authority certificates to use in verifying
a presented peer certificate (e.g. server certificate for clusters or client certificate
for listeners).
|
DataSourceOrBuilder |
getTrustedCaOrBuilder()
TLS certificate data containing certificate authority certificates to use in verifying
a presented peer certificate (e.g. server certificate for clusters or client certificate
for listeners).
|
String |
getVerifyCertificateHash(int index)
An optional list of hex-encoded SHA-256 hashes.
|
com.google.protobuf.ByteString |
getVerifyCertificateHashBytes(int index)
An optional list of hex-encoded SHA-256 hashes.
|
int |
getVerifyCertificateHashCount()
An optional list of hex-encoded SHA-256 hashes.
|
List<String> |
getVerifyCertificateHashList()
An optional list of hex-encoded SHA-256 hashes.
|
String |
getVerifyCertificateSpki(int index)
An optional list of base64-encoded SHA-256 hashes.
|
com.google.protobuf.ByteString |
getVerifyCertificateSpkiBytes(int index)
An optional list of base64-encoded SHA-256 hashes.
|
int |
getVerifyCertificateSpkiCount()
An optional list of base64-encoded SHA-256 hashes.
|
List<String> |
getVerifyCertificateSpkiList()
An optional list of base64-encoded SHA-256 hashes.
|
String |
getVerifySubjectAltName(int index)
Deprecated.
|
com.google.protobuf.ByteString |
getVerifySubjectAltNameBytes(int index)
Deprecated.
|
int |
getVerifySubjectAltNameCount()
Deprecated.
|
List<String> |
getVerifySubjectAltNameList()
Deprecated.
|
boolean |
hasCrl()
An optional `certificate revocation list
<https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
(in PEM format).
|
boolean |
hasRequireOcspStaple()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
|
boolean |
hasRequireSignedCertificateTimestamp()
[#not-implemented-hide:] Must present signed certificate time-stamp.
|
boolean |
hasTrustedCa()
TLS certificate data containing certificate authority certificates to use in verifying
a presented peer certificate (e.g. server certificate for clusters or client certificate
for listeners).
|
findInitializationErrors, getAllFields, getDefaultInstanceForType, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneofboolean hasTrustedCa()
TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners). If not specified and a peer certificate is presented it will not be verified. By default, a client certificate is optional, unless one of the additional options (:ref:`require_client_certificate <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`, :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`, :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or :ref:`match_subject_alt_names <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also specified. It can optionally contain certificate revocation lists, in which case Envoy will verify that the presented peer certificate has not been revoked by one of the included CRLs. See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common system CA locations.
.envoy.api.v2.core.DataSource trusted_ca = 1;DataSource getTrustedCa()
TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners). If not specified and a peer certificate is presented it will not be verified. By default, a client certificate is optional, unless one of the additional options (:ref:`require_client_certificate <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`, :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`, :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or :ref:`match_subject_alt_names <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also specified. It can optionally contain certificate revocation lists, in which case Envoy will verify that the presented peer certificate has not been revoked by one of the included CRLs. See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common system CA locations.
.envoy.api.v2.core.DataSource trusted_ca = 1;DataSourceOrBuilder getTrustedCaOrBuilder()
TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners). If not specified and a peer certificate is presented it will not be verified. By default, a client certificate is optional, unless one of the additional options (:ref:`require_client_certificate <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`, :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`, :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or :ref:`match_subject_alt_names <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also specified. It can optionally contain certificate revocation lists, in which case Envoy will verify that the presented peer certificate has not been revoked by one of the included CRLs. See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common system CA locations.
.envoy.api.v2.core.DataSource trusted_ca = 1;List<String> getVerifyCertificateSpkiList()
An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
matches one of the specified values.
A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
can be generated with the following command:
.. code-block:: bash
$ openssl x509 -in path/to/client.crt -noout -pubkey
| openssl pkey -pubin -outform DER
| openssl dgst -sha256 -binary
| openssl enc -base64
NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
This is the format used in HTTP Public Key Pinning.
When both:
:ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
:ref:`verify_certificate_spki
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
a hash matching value from either of the lists will result in the certificate being accepted.
.. attention::
This option is preferred over :ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
because SPKI is tied to a private key, so it doesn't change when the certificate
is renewed using the same private key.
repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }int getVerifyCertificateSpkiCount()
An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
matches one of the specified values.
A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
can be generated with the following command:
.. code-block:: bash
$ openssl x509 -in path/to/client.crt -noout -pubkey
| openssl pkey -pubin -outform DER
| openssl dgst -sha256 -binary
| openssl enc -base64
NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
This is the format used in HTTP Public Key Pinning.
When both:
:ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
:ref:`verify_certificate_spki
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
a hash matching value from either of the lists will result in the certificate being accepted.
.. attention::
This option is preferred over :ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
because SPKI is tied to a private key, so it doesn't change when the certificate
is renewed using the same private key.
repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }String getVerifyCertificateSpki(int index)
An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
matches one of the specified values.
A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
can be generated with the following command:
.. code-block:: bash
$ openssl x509 -in path/to/client.crt -noout -pubkey
| openssl pkey -pubin -outform DER
| openssl dgst -sha256 -binary
| openssl enc -base64
NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
This is the format used in HTTP Public Key Pinning.
When both:
:ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
:ref:`verify_certificate_spki
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
a hash matching value from either of the lists will result in the certificate being accepted.
.. attention::
This option is preferred over :ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
because SPKI is tied to a private key, so it doesn't change when the certificate
is renewed using the same private key.
repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }com.google.protobuf.ByteString getVerifyCertificateSpkiBytes(int index)
An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
matches one of the specified values.
A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
can be generated with the following command:
.. code-block:: bash
$ openssl x509 -in path/to/client.crt -noout -pubkey
| openssl pkey -pubin -outform DER
| openssl dgst -sha256 -binary
| openssl enc -base64
NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
This is the format used in HTTP Public Key Pinning.
When both:
:ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
:ref:`verify_certificate_spki
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
a hash matching value from either of the lists will result in the certificate being accepted.
.. attention::
This option is preferred over :ref:`verify_certificate_hash
<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
because SPKI is tied to a private key, so it doesn't change when the certificate
is renewed using the same private key.
repeated string verify_certificate_spki = 3 [(.validate.rules) = { ... }List<String> getVerifyCertificateHashList()
An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded presented certificate matches one of the specified values. A hex-encoded SHA-256 of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2 df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2 DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A Both of those formats are acceptable. When both: :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified, a hash matching value from either of the lists will result in the certificate being accepted.
repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }int getVerifyCertificateHashCount()
An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded presented certificate matches one of the specified values. A hex-encoded SHA-256 of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2 df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2 DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A Both of those formats are acceptable. When both: :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified, a hash matching value from either of the lists will result in the certificate being accepted.
repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }String getVerifyCertificateHash(int index)
An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded presented certificate matches one of the specified values. A hex-encoded SHA-256 of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2 df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2 DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A Both of those formats are acceptable. When both: :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified, a hash matching value from either of the lists will result in the certificate being accepted.
repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }com.google.protobuf.ByteString getVerifyCertificateHashBytes(int index)
An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded presented certificate matches one of the specified values. A hex-encoded SHA-256 of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2 df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate can be generated with the following command: .. code-block:: bash $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2 DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A Both of those formats are acceptable. When both: :ref:`verify_certificate_hash <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and :ref:`verify_certificate_spki <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified, a hash matching value from either of the lists will result in the certificate being accepted.
repeated string verify_certificate_hash = 2 [(.validate.rules) = { ... }@Deprecated List<String> getVerifySubjectAltNameList()
An optional list of Subject Alternative Names. If specified, Envoy will verify that the Subject Alternative Name of the presented certificate matches one of the specified values. .. attention:: Subject Alternative Names are easily spoofable and verifying only them is insecure, therefore this option must be used together with :ref:`trusted_ca <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated string verify_subject_alt_name = 4 [deprecated = true];@Deprecated int getVerifySubjectAltNameCount()
An optional list of Subject Alternative Names. If specified, Envoy will verify that the Subject Alternative Name of the presented certificate matches one of the specified values. .. attention:: Subject Alternative Names are easily spoofable and verifying only them is insecure, therefore this option must be used together with :ref:`trusted_ca <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated string verify_subject_alt_name = 4 [deprecated = true];@Deprecated String getVerifySubjectAltName(int index)
An optional list of Subject Alternative Names. If specified, Envoy will verify that the Subject Alternative Name of the presented certificate matches one of the specified values. .. attention:: Subject Alternative Names are easily spoofable and verifying only them is insecure, therefore this option must be used together with :ref:`trusted_ca <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated string verify_subject_alt_name = 4 [deprecated = true];@Deprecated com.google.protobuf.ByteString getVerifySubjectAltNameBytes(int index)
An optional list of Subject Alternative Names. If specified, Envoy will verify that the Subject Alternative Name of the presented certificate matches one of the specified values. .. attention:: Subject Alternative Names are easily spoofable and verifying only them is insecure, therefore this option must be used together with :ref:`trusted_ca <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated string verify_subject_alt_name = 4 [deprecated = true];List<StringMatcher> getMatchSubjectAltNamesList()
An optional list of Subject Alternative name matchers. Envoy will verify that the
Subject Alternative Name of the presented certificate matches one of the specified matches.
When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
it should be configured as shown below.
.. code-block:: yaml
match_subject_alt_names:
exact: "api.example.com"
.. attention::
Subject Alternative Names are easily spoofable and verifying only them is insecure,
therefore this option must be used together with :ref:`trusted_ca
<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;StringMatcher getMatchSubjectAltNames(int index)
An optional list of Subject Alternative name matchers. Envoy will verify that the
Subject Alternative Name of the presented certificate matches one of the specified matches.
When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
it should be configured as shown below.
.. code-block:: yaml
match_subject_alt_names:
exact: "api.example.com"
.. attention::
Subject Alternative Names are easily spoofable and verifying only them is insecure,
therefore this option must be used together with :ref:`trusted_ca
<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;int getMatchSubjectAltNamesCount()
An optional list of Subject Alternative name matchers. Envoy will verify that the
Subject Alternative Name of the presented certificate matches one of the specified matches.
When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
it should be configured as shown below.
.. code-block:: yaml
match_subject_alt_names:
exact: "api.example.com"
.. attention::
Subject Alternative Names are easily spoofable and verifying only them is insecure,
therefore this option must be used together with :ref:`trusted_ca
<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;List<? extends StringMatcherOrBuilder> getMatchSubjectAltNamesOrBuilderList()
An optional list of Subject Alternative name matchers. Envoy will verify that the
Subject Alternative Name of the presented certificate matches one of the specified matches.
When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
it should be configured as shown below.
.. code-block:: yaml
match_subject_alt_names:
exact: "api.example.com"
.. attention::
Subject Alternative Names are easily spoofable and verifying only them is insecure,
therefore this option must be used together with :ref:`trusted_ca
<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;StringMatcherOrBuilder getMatchSubjectAltNamesOrBuilder(int index)
An optional list of Subject Alternative name matchers. Envoy will verify that the
Subject Alternative Name of the presented certificate matches one of the specified matches.
When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
it should be configured as shown below.
.. code-block:: yaml
match_subject_alt_names:
exact: "api.example.com"
.. attention::
Subject Alternative Names are easily spoofable and verifying only them is insecure,
therefore this option must be used together with :ref:`trusted_ca
<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
repeated .envoy.type.matcher.StringMatcher match_subject_alt_names = 9;boolean hasRequireOcspStaple()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
.google.protobuf.BoolValue require_ocsp_staple = 5;com.google.protobuf.BoolValue getRequireOcspStaple()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
.google.protobuf.BoolValue require_ocsp_staple = 5;com.google.protobuf.BoolValueOrBuilder getRequireOcspStapleOrBuilder()
[#not-implemented-hide:] Must present a signed time-stamped OCSP response.
.google.protobuf.BoolValue require_ocsp_staple = 5;boolean hasRequireSignedCertificateTimestamp()
[#not-implemented-hide:] Must present signed certificate time-stamp.
.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;com.google.protobuf.BoolValue getRequireSignedCertificateTimestamp()
[#not-implemented-hide:] Must present signed certificate time-stamp.
.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;com.google.protobuf.BoolValueOrBuilder getRequireSignedCertificateTimestampOrBuilder()
[#not-implemented-hide:] Must present signed certificate time-stamp.
.google.protobuf.BoolValue require_signed_certificate_timestamp = 6;boolean hasCrl()
An optional `certificate revocation list <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format). If specified, Envoy will verify that the presented peer certificate has not been revoked by this CRL. If this DataSource contains multiple CRLs, all of them will be used.
.envoy.api.v2.core.DataSource crl = 7;DataSource getCrl()
An optional `certificate revocation list <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format). If specified, Envoy will verify that the presented peer certificate has not been revoked by this CRL. If this DataSource contains multiple CRLs, all of them will be used.
.envoy.api.v2.core.DataSource crl = 7;DataSourceOrBuilder getCrlOrBuilder()
An optional `certificate revocation list <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_ (in PEM format). If specified, Envoy will verify that the presented peer certificate has not been revoked by this CRL. If this DataSource contains multiple CRLs, all of them will be used.
.envoy.api.v2.core.DataSource crl = 7;boolean getAllowExpiredCertificate()
If specified, Envoy will not reject expired certificates.
bool allow_expired_certificate = 8;int getTrustChainVerificationValue()
Certificate trust chain verification mode.
.envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification trust_chain_verification = 10 [(.validate.rules) = { ... }CertificateValidationContext.TrustChainVerification getTrustChainVerification()
Certificate trust chain verification mode.
.envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification trust_chain_verification = 10 [(.validate.rules) = { ... }Copyright © 2018–2021 The Envoy Project. All rights reserved.