Envoy is a high-performance open-source edge and service proxy designed for cloud-native applications. It is often used to manage microservices traffic, providing features like load balancing, service discovery, and observability. One of its key functionalities is SSL termination, which allows Envoy to handle incoming encrypted traffic by decrypting it before forwarding it to backend services.
When Envoy is not terminating SSL as expected, you might observe that encrypted traffic is not being decrypted, leading to failed connections or errors in communication with backend services. This issue can manifest as an inability to establish a secure connection or as an error message indicating SSL handshake failures.
The root cause of Envoy not terminating SSL often lies in misconfiguration. This can include incorrect SSL certificate paths, missing private keys, or improperly configured listener settings. Ensuring that Envoy is correctly set up to handle SSL termination is crucial for maintaining secure communications.
tls_context configuration in the Envoy listener.To resolve the issue of Envoy not terminating SSL, follow these steps:
Ensure that the paths to your SSL certificate and private key are correct and accessible by Envoy. Check the tls_context configuration in your Envoy YAML file:
static_resources:
listeners:
- name: listener_0
address:
socket_address: { address: 0.0.0.0, port_value: 443 }
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
config:
codec_type: AUTO
stat_prefix: ingress_http
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: ["*"]
routes:
- match: { prefix: "/" }
route: { cluster: service_cluster }
http_filters:
- name: envoy.filters.http.router
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
common_tls_context:
tls_certificates:
- certificate_chain: { filename: "/etc/envoy/certs/server.crt" }
private_key: { filename: "/etc/envoy/certs/server.key" }
Ensure that your listener is correctly configured to handle SSL traffic. The transport_socket section should be properly set up to use TLS.
If you are using SNI, ensure that the SNI settings match the domain names you are serving. This can be configured under the filter_chains section.
After making the necessary changes, restart Envoy and test the configuration by attempting to connect to your service using a tool like cURL or OpenSSL to ensure that SSL termination is functioning correctly.
By following these steps, you should be able to resolve issues related to Envoy not terminating SSL. Proper configuration of SSL certificates, keys, and listener settings is crucial for maintaining secure and reliable communications in your microservices architecture. For more detailed information, refer to the Envoy Listener Configuration documentation.
Let Dr. Droid create custom investigation plans for your infrastructure.
Book Demo
