Upstream Https

[MekelCon]

Hello,

i am trying to configure an usptream, using https
1 - Create SSL config

curl --location --request PUT "<host>/apisix/admin/ssls/epicSSL" --header "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" --header "Content-Type: application/json" --data-raw "{
    \"type\": \"client\",
    \"snis\" : [\"<myHost>\"],
    \"cert\": \"-----BEGIN CERTIFICATE-----...\n-----END CERTIFICATE-----\n\",
    \"key\": \"-----BEGIN PRIVATE KEY-----...\n-----END PRIVATE KEY-----\n\"
}"

2 - Create the upstream

curl --location --request PUT "<host>/apisix/admin/upstreams/epicUpstream" --header "x-api-key: edd1c9f034335f136f87ad84b625c8f1" --header "Content-Type: application/json" --data-raw "{
    \"type\": \"roundrobin\",
    \"scheme\": \"https\",
    \"pass_host\" : \"node\",
    \"nodes\": {
        \"<myHost>:8088\": 1
    },
    \"tls\": {
        \"client_cert_id\": \"epicSSL\"
    }
}"

3 - Create the route :

curl --location --request PUT "<host>/apisix/admin/routes/epicRoute" --header "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" --header "Content-Type: application/json" --data-raw "{
    \"methods\": [
        \"POST\"
    ],
    \"uri\": \"/my-path/*\",
    \"upstream_id\": \"epicUpstream\"
}"

4 - Try to consume

curl --location --request POST "http://<consumption-host>/<my-path>/bla" --header "Content-Type: application/json" --data-raw "{
    \"event\" : {
        \"hello\" : \"world\"
    }
}"

It works BUT i try to put a certificate not matching what is exposed by my targeted server and it is still
So i guess the connection is done without validating the certifcate anyway (insecure by default ) ?
2nd question i don't understand why the private key is needed ? Adding only the public should be enough to do HTTPS as client.
I there a complete example of configuring an uspstream with https and certificate validation ?
Using curl, the target upstream is only accessible using -k option, or by adding the right cert, i expected the same behavior when consuming through Apisix.

Thank you,

Thibault

[MekelCon]

So i build with Apisix-Base.
I have MTLS working, but what i want is not MTLS, it is only to validate de server/backend certificate.
The target will not validate mine.

[MekelCon]

https://apisix.apache.org/docs/apisix/mtls/#how-to-configure-3
Reading this I see nothing about validating the certificate of the target, so it is just not possible ?

[tokers]

If you don't need the mTLS capability, you don't need to configure the upstream.tls.client_cert_id field.

[tokers]

If I remember correctly, you can inject the Nginx proxy_ssl_verify directive to on with the https://apisix.apache.org/docs/apisix/customize-nginx-configuration/.

But please be careful, as this change is global.