Enhancing Envoy: Certificate Handling at the Edge
summary
Adds an OpenSSL extension for Envoy so Envoy can link OS-provided crypto, enabling FIPS 140-2 workflows instead of being tied to BoringSSL; extracts TLS/crypto into transport socket extensions, supplies scripts that replace BoringSSL with OpenSSL across Bazel and distro builds, and lands code in a new envoyproxy repo with a 0.11-based image. Certification pain point: recertifying changes costs ~3–6 months and ~$100k; work is functional and upstream CI now tests the OpenSSL path.
AI-written summary · about
chapters (4)
- 0:00Start
- 5:10Public Key Cryptography Standards
- 7:46Why Does this Matter
- 12:03Adding Back Support for Open Ssl
related talks
36mEnhancing Envoy: Certificate Handling at the Edge
29mUnderstanding, maintaining and securing Envoy's supply chain
34mIntro: Envoy
23mUsing Envoy as an Egress Proxy for TLS Enabled Traffic
27mEnvoy - Overview and Update: Senior Envoy Maintainer
21mDeep Dive: Envoy
42mAccelerating Envoy with the Linux Kernel
20mBuilding an Edge Control Plane with Kubernetes and Envoy