Enhancing Envoy: Certificate Handling at the Edge
summary
Envoy gains pluggable OpenSSL support to let distributions use system crypto instead of BoringSSL, with code moved into transport socket and TLS listener extensions and a first OpenSSL-enabled release (0.11) available. Work produces an OpenSSL extension repo and CI that builds OpenSSL variants, tackles BoringSSL leaks (quiche dependency), and enables Red Hat’s FIPS 140-2 certification workflow using an OpenSSL capsule; recertification costs are ~3–6 months and >$100k per change.
AI-written summary · about
chapters (15)
- 0:00Start
- 2:53BORING SSL
- 3:54Let's go back in time
- 5:08PUBLIC KEY CRYPTOGRAPHY STANDARDS
- 5:46PKCS#12
- 8:10STANDARDS ARE IMPORTANT
- 8:30BORING OPEN SSL
- 11:40fair enough... sounds pretty reasonable
- 11:53but time is a fickle mistress
- 12:52and therein lies the challenge
- 13:17we need stewards who understand the technology to represent the larger community
- 13:27PRODUCTS PROJECTS
- 13:38OpenShift Service Mesh
- 18:33IF YOU CHANGE THE CODE ...YOU HAVE TO RE-CERTIFY
- 20:10THIS WORKFLOW IS CRITICAL TO CERTIFICATION
related talks
36mEnhancing Envoy: Certificate Handling at the Edge
29mUnderstanding, maintaining and securing Envoy's supply chain
23mUsing Envoy as an Egress Proxy for TLS Enabled Traffic
35mEnvoy Maintainer Q+A
20mBuilding an Edge Control Plane with Kubernetes and Envoy
42mAccelerating Envoy with the Linux Kernel
21mDeep Dive: Envoy
36mSecuring Every Bit