Enable GatewayInvalidTLSConfiguration conformance test

[arkodg]

Seeing this conformance test fail in in #780

Once fixed it should be enabled via https://github.com/envoyproxy/gateway/blob/main/test/conformance/conformance_test.go

[LanceEa]

@arkodg - I was looking through the milestone for the next release and saw this one. Has anyone picked this one up? Happy to help out on it, unless there is another one like cors support or something that the team would rather be landed first?

[arkodg]

hey @LanceEa feel free to pick this up, and thanks !

[LanceEa]

Leaving some historical information here for context.

My implementation is based on K8s docs:
https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets

The docs read a little weird in that it implies that it supports der format (binary) but I tested
kubectl create secret tls rsa-pkcs8-tls-secret --cert=./rsa-cert.der --key=./rsa-pkcs8.key --namespace default and K8s will not accept the binary format complaining about not being able to find a cert pem-encoding.

As for the private key, the K8s docs suggest that the private key is in pkcs8 format per this https://datatracker.ietf.org/doc/html/rfc7468#section-11. However, I was able to successfully apply the following:

kubectl create secret tls rsa-pkcs1-tls-secret --cert=./rsa-cert.pem --key=./rsa-pkcs1.key --namespace default
kubectl create secret tls rsa-pkcs8-tls-secret --cert=./rsa-cert.pem --key=./rsa-pkcs8.key --namespace default
kubectl create secret tls ecdsa-p256-tls-secret --cert=./ecdsa-p256-cert.pem --key=./ecdsa-p256.key --namespace default

So, the implementation supports parsing all three types of private keys starting with pkcs8 as the default and falling-back to trying to parse the other formats.

Side-note: conformance doesn't mention whether we should validate anything in the cert. Would be a nice-to-have for a developer dx, where it would also check that the hostname for the listener matches the domains in the cert for sni. This way the platform admin gets feedback before envoy is configured and not working.