{"action":"created","issue":{"url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/90","repository_url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release","labels_url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/90/comments","events_url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/90/events","html_url":"https://github.com/cloudfoundry-incubator/routing-release/issues/90","id":270889657,"number":90,"title":"Working of mTLS","user":{"login":"rahul221192","id":16372337,"avatar_url":"https://avatars0.githubusercontent.com/u/16372337?v=4","gravatar_id":"","url":"https://api.github.com/users/rahul221192","html_url":"https://github.com/rahul221192","followers_url":"https://api.github.com/users/rahul221192/followers","following_url":"https://api.github.com/users/rahul221192/following{/other_user}","gists_url":"https://api.github.com/users/rahul221192/gists{/gist_id}","starred_url":"https://api.github.com/users/rahul221192/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rahul221192/subscriptions","organizations_url":"https://api.github.com/users/rahul221192/orgs","repos_url":"https://api.github.com/users/rahul221192/repos","events_url":"https://api.github.com/users/rahul221192/events{/privacy}","received_events_url":"https://api.github.com/users/rahul221192/received_events","type":"User","site_admin":false},"labels":[{"id":371027262,"url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/labels/unscheduled","name":"unscheduled","color":"D9D9D9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-11-03T06:39:49Z","updated_at":"2017-11-06T18:39:28Z","closed_at":null,"author_association":"NONE","body":"Hi team,\r\n\r\nIts a question rather than issue regarding the working of mTLS.\r\n\r\nI just wanted in how many we are using mTLS in cloud foundry i.e.\r\ni have some use cases can you please help how i can use mTLS in given below cases.\r\n\r\n1. If i push a application on cloud foundry ,do i need to add certs in application itself. If yes what changes would i need to do it cloud foundry deployment. Is Credhub is mandatory requirement and how its going to work?\r\n\r\n2. From docs what i can understand there is use case of mTLS to make platform secure for inner communication too.So https://github.com/cloudfoundry/cf-release/blob/master/on-tls-certificates.md this for securing internal communication between components.\r\n\r\n3. If i want to communicate third party apps to application running cloud foundry how mtls can help?\r\n\r\n4.If i want to communicate **2 apps using **same domain**** name running on cloudfoundry with each other is ,there is requirement of mtls to make connection secure.\r\n\r\n5.If i want to communicate **2 apps using **different domain**** name running on cloudfoundry with each other, is there is requirement of mtls to make connection secure.\r\n\r\nthanks in advance "},"comment":{"url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/comments/342243917","html_url":"https://github.com/cloudfoundry-incubator/routing-release/issues/90#issuecomment-342243917","issue_url":"https://api.github.com/repos/cloudfoundry-incubator/routing-release/issues/90","id":342243917,"user":{"login":"aaronshurley","id":6414720,"avatar_url":"https://avatars2.githubusercontent.com/u/6414720?v=4","gravatar_id":"","url":"https://api.github.com/users/aaronshurley","html_url":"https://github.com/aaronshurley","followers_url":"https://api.github.com/users/aaronshurley/followers","following_url":"https://api.github.com/users/aaronshurley/following{/other_user}","gists_url":"https://api.github.com/users/aaronshurley/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronshurley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronshurley/subscriptions","organizations_url":"https://api.github.com/users/aaronshurley/orgs","repos_url":"https://api.github.com/users/aaronshurley/repos","events_url":"https://api.github.com/users/aaronshurley/events{/privacy}","received_events_url":"https://api.github.com/users/aaronshurley/received_events","type":"User","site_admin":false},"created_at":"2017-11-06T18:39:28Z","updated_at":"2017-11-06T18:39:28Z","author_association":"CONTRIBUTOR","body":"@georgibarzev \r\n\r\n> For a scenario when I'm trying to authenticate an external or internal client to, let's say, a Java app running on the current implementation of Cloud Foundry. If the app includes keystore cert configuration in the application code, would it be enough/possible to configure the load balancer and gorouters to forward the client certificate (as documented here https://docs.cloudfoundry.org/concepts/http-routing.html#forward-client-cert) and let the Java app handle the client certificate resolution?\r\n\r\nIf we understand your scenario, it sounds like you want to use `router.forwarded_client_cert: sanitize_set` so that the gorouter will strip any XFCC headers and then will set the client cert to be validated by the Java app.\r\n\r\n> Just to clarify, which version of cf introduced client cert forwarding?\r\n\r\nWe introduced mTLS and X-Forwarded-Client-Cert in [routing-release v0.160.0](https://github.com/cloudfoundry-incubator/routing-release/tree/0.160.0) which was first introduced to cf-release in [v275](https://github.com/cloudfoundry/cf-release/tree/v275).\r\n\r\n> Is the future diego/gorouter platform implementation going to allow different certs to be trusted by the individual apps and if so would they be configured by the developer or the platform admin?\r\n\r\nThis should be possible to do now with the above XFCC header and also in the future, this isn't expected to change.\r\n\r\nAaron && Edwin"}}
{"actor":{"display_login":"aaronshurley"}}