Project: Gloo (Orchestration & Management / API Gateway)
File: ssl.proto.sk.md

title: "ssl.proto" weight: 5 <!-- Code generated by solo-kit. DO NOT EDIT. --> SslConfig contains the options necessary to configure a virtual host or listener to use TLS termination ```yaml "secretRef": .core.solo.io.ResourceRef "sslFiles": .gloo.solo.io.SSLFiles "sds": .gloo.solo.io.SDSConfig "sniDomains": []string "verifySubjectAltName": []string "parameters": .gloo.solo.io.SslParameters "alpnProtocols": []string "oneWayTls": .google.protobuf.BoolValue "disableTlsSessionResumption": .google.protobuf.BoolValue "transportSocketConnectTimeout": .google.protobuf.Duration "ocspStaplePolicy": .gloo.solo.io.SslConfig.OcspStaplePolicy ``` | Field | Type | Description | | -- | - | -- | | `secretRef` | | SecretRef contains the secret ref to a gloo tls secret or a kubernetes tls secret. gloo tls secret can contain a root ca as well if verification is needed. Only one of `secretRef`, `sslFiles`, or `sds` can be set. | | `sslFiles` | | SSLFiles reference paths to certificates which are local to the proxy. Only one of `sslFiles`, `secretRef`, or `sds` can be set. | | `sds` | | Use secret discovery service. Only one of `sds`, `secretRef`, or `sslFiles` can be set. | | `sniDomains` | `[]string` | optional. the SNI domains that should be considered for TLS connections. | | `verifySubjectAltName` | `[]string` | Verify that the Subject Alternative Name in the peer certificate is one of the specified values. note that a root_ca must be provided if this option is used. | | `parameters` | | | | `alpnProtocols` | `[]string` | Set Application Level Protocol Negotiation If empty, defaults to ["h2", "http/1.1"]. As an advanced option you may use ["allow_empty"] to avoid defaults and set alpn to have no alpn set (ie pass empty slice). | | `oneWayTls` | | If the SSL config has the ca.crt (root CA) provided, Gloo uses it to perform mTLS by default. Set oneWayTls to true to disable mTLS in favor of server-only TLS (one-way TLS), even if Gloo has the root CA. If unset, defaults to false. | | `disableTlsSessionResumption` | | If set to true, the TLS session resumption will be deactivated, note that it deactivates only the tickets based tls session resumption (not the cache). | | `transportSocketConnectTimeout` | | If present and nonzero, the amount of time to allow incoming connections to complete any transport socket negotiations. If this expires before the transport reports connection establishment, the connection is summarily closed. | | `ocspStaplePolicy` | | The OCSP staple policy to use for this listener. Defaults to `LENIENTSTAPLING`. https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transportsockets/tls/v3/tls.proto#enum-extensions-transport-sockets-tls-v3-downstreamtlscontext-ocspstaplepolicy. | | Name | Description | | -- | -- | | `LENIENT_STAPLING` | OCSP responses are optional. If none is provided, or the provided response is expired, the associated certificate will be used without the OCSP response. | | `STRICT_STAPLING` | OCSP responses are optional. If none is provided, the associated certificate will be used without the OCSP response. If a response is present, but expired, the certificate will not be used for connections. If no suitable certificate is found, the connection is rejected. | | `MUSTSTAPLE` | OCSP responses are required. If no `ocspstaple` is set on a certificate, configuration will fail. If a response is expired, the associated certificate will not be used. If no suitable certificate is found, the connection is

| SSLFiles reference paths to certificates which can be read by the proxy off of its local filesystem ```yaml "tlsCert": string "tlsKey": string "rootCa": string "ocspStaple": string ``` | Field | Type | Description | | -- | - | -- | | `tlsCert` | `string` | | | `tlsKey` | `string` | | | `rootCa` | `string` | for client cert validation. optional. | | `ocspStaple` | `string` | stapled ocsp response. optional should be der-encoded. | SslConfig contains the options necessary to configure an upstream to use TLS origination ```yaml "secretRef": .core.solo.io.ResourceRef "sslFiles": .gloo.solo.io.SSLFiles "sds": .gloo.solo.io.SDSConfig "sni": string "verifySubjectAltName": []string "parameters": .gloo.solo.io.SslParameters "alpnProtocols": []string "allowRenegotiation": .google.protobuf.BoolValue ``` | Field | Type | Description | | -- | - | -- | | `secretRef` | | SecretRef contains the secret ref to a gloo tls secret or a kubernetes tls secret. gloo tls secret can contain a root ca as well if verification is needed. Only one of `secretRef`, `sslFiles`, or `sds` can be set. | | `sslFiles` | | SSLFiles reference paths to certificates which are local to the proxy. Only one of `sslFiles`, `secretRef`, or `sds` can be set. | | `sds` | | Use secret discovery service. Only one of `sds`, `secretRef`, or `sslFiles` can be set. | | `sni` | `string` | optional. the SNI domains that should be considered for TLS connections. | | `verifySubjectAltName` | `[]string` | Verify that the Subject Alternative Name in the peer certificate is one of the specified values. note that a root_ca must be provided if this option is used. | | `parameters` | | | | `alpnProtocols` | `[]string` | Set Application Level Protocol Negotiation. If empty, it is not set. | | `allowRenegotiation` | | Allow Tls renegotiation, the default value is false. TLS renegotiation is considered insecure and shouldnt be used unless absolutely necessary. | ```yaml "targetUri": string "callCredentials": .gloo.solo.io.CallCredentials "clusterName": string "certificatesSecretName": string "validationContextName": string ``` | Field | Type | Description | | -- | - | -- | | `targetUri` | `string` | Target uri for the sds channel. currently only a unix domain socket is supported. | | `callCredentials` | | Call credentials. Only one of `callCredentials` or `clusterName` can be set. | | `clusterName` | `string` | The name of the sds cluster in envoy. Only one of `clusterName` or `callCredentials` can be set. | | `certificatesSecretName` | `string` | The name of the secret containing the certificate. | | `validationContextName` | `string` | The name of secret containing the validation context (i.e. root ca). | ```yaml "fileCredentialSource": .gloo.solo.io.CallCredentials.FileCredentialSource ``` | Field | Type | Description | | -- | - | -- | | `fileCredentialSource` | | Call credentials are coming from a file,. | ```yaml "tokenFileName": string "header": string ``` | Field | Type | Description | | -- | - | -- | | `tokenFileName` | `string` | File containing auth token. | | `header` | `string` | Header to carry the token. | General TLS parameters. See the for more information on the meaning of these values. ```yaml "minimumProtocolVersion": .gloo.solo.io.SslParameters.ProtocolVersion "maximumProtocolVersion": .gloo.solo.io.SslParameters.ProtocolVersion "cipherSuites": []string "ecdhCurves": []string ``` | Field | Type | Description | | -- | - | -- | | `minimumProtocolVersion` | | | | `maximumProtocolVersion` | | | | `cipherSuites` | `[]string` | | | `ecdhCurves` | `[]string` | | | Name | Description | | -- | -- | | `TLS_AUTO` | Envoy will choose the optimal TLS version. | | `TLSv1_0` | TLS 1.0 | | `TLSv1_1` | TLS 1.1 | | `TLSv1_2` | TLS 1.2 | | `TLSv1_3` | TLS