SSL handshake fails because of too many certificate authorities
#14,208 opened on Nov 30, 2020
Repository metrics
- Stars
- (27,997 stars)
- PR merge metrics
- (Avg merge 8d) (378 merged PRs in 30d)
Description
Title: Initial ssl handshake fails because the ca cert file contains too many certificates (e.g more than 500 certificate authorities) in server side
Description: During Initial ssl handshake if client authentication is enabled, envoy server will request client certificate by sending CertificateRequest msg[1]. A list of the distinguished names [X501] of certificates in ca cert file will be sent to the client. According to the rfc5246 [1], the maximum size of collections of distinguished names is (2^16-1) bytes. Therefore, if the number of distinguished names is more than a certain amount, the handshake will fail.
But according to the rfc5246[1], the handshake step by TLS/SSL server side to send the list of the distinguished names [X501] of certificates is optional.
If the certificate_authorities list is empty, then the client MAY send any certificate of the appropriate ClientCertificateType, unless there is some external arrangement to the contrary.
Is there a way to send an empty list in this handshake step, instead of a list of existing distinguished names of certificates?
Thanks!