-
Notifications
You must be signed in to change notification settings - Fork 1k
Remove localhost restriction from LDS registration certificate validation #3352
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
|
…tion The RegistrationValidator_CertificateValidation method prevented remote LDS registration by requiring the LDS certificate domain to match the local hostname. This change removes that restrictive validation and relies on the standard certificate validator which properly checks certificate chain, expiration, trusted certificates, and revocation lists. Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
| await configuration | ||
| .CertificateValidator.UpdateAsync( | ||
| configuration.SecurityConfiguration, | ||
| applicationUri: null, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@copilot please take applicationUri from configuration instead of passing null, to ensure appliction certificates are loaded also if the subject name is changed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done in 54e3217. Changed from applicationUri: null to configuration.ApplicationUri to ensure application certificates are loaded correctly even if the subject name is changed.
This ensures application certificates are loaded correctly even if the subject name is changed. Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
Proposed changes
The
RegistrationValidator_CertificateValidationmethod prevented servers from registering with remote LDS/LDS-ME servers by requiring the LDS certificate domain to resolve to the local hostname's IP address.Changes:
RegistrationValidator_CertificateValidationmethod and its event handler registrationCertificateValidatorwhich validates certificate chain, expiration, trust stores, and revocation listsconfiguration.ApplicationUritoUpdateAsyncinstead ofnullto ensure application certificates are loaded correctly even if the subject name is changedThis maintains security through proper certificate validation while enabling remote LDS registration.
Related Issues
Types of changes
Checklist
Further comments
Testing: 156/156 server tests and 7836/7836 core tests passed. No new security issues detected.
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.