kubernetes-sigs/aws-load-balancer-controller

Adding default certificate to the certificate list for SNI client connections

Open

#4,090 opened on Mar 13, 2025

View on GitHubContributor guide
 (8 comments) (2 reactions) (0 assignees)Go (1,644 forks)auto 404
good first issue

Repository metrics

Stars
 (4,317 stars)
PR merge metrics
 (PR metrics pending)

Description

Describe the feature you are requesting Scenarios in controller certificate auto-discovery;

  • where different encryption certificate (ECC, RSA) are auto-discovered
  • the ECC certificate is discovered first and in the LB model is created as the default certificate
  • the RSA encyption certificate is discovered ...and any other certificate, and added to the certificate ilst
  • From the ALB documentation, however, the default certificate is never used when a client request specifies the SNI and there is a certificate list
  • client attempting to negotiate ECC cipher suite with an ALB only checking only the certificate list fails TLS negotiation

Motivation

  • the ALB spec would seem to expect the default certificate to also be added to the certificate list

Describe the proposed solution you'd like

  • Add the default certificate also to the certificate list. Perhaps appending the certificate twice?

Contribution Intention (Optional)

  • Yes, I am willing to contribute a PR to implement this feature

Contributor guide

Research direction
Inspect the certificate auto discovery flow in pkg/service/model build listener.go, understand how the default certificate is selected and how the certificate list is populated. Review the ALB documentation on SNI behavior to verify the issue, and consider adding the default certificate to the list as well. Test the change with unit tests.
Tech stack
goaws
Domain
backendinfrastructure
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GitGo
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75