kong.client.tls

Client TLS connection module.

A set of functions for interacting with TLS connections from the client.

kong.client.tls.request_client_certificate([ca_certs])

Requests the client to present its client-side certificate to initiate mutual TLS authentication between server and client.

This function requests, but does not require the client to start the mTLS process. The TLS handshake can still complete even if the client doesn’t present a client certificate. However, in that case, it becomes a TLS connection instead of an mTLS connection, as there is no mutual authentication.

To find out whether the client honored the request, use get_full_client_certificate_chain in later phases.

The ca_certs argument is the optional CA certificate chain opaque pointer, which can be created by the parse_pem_cert or resty.opensslx509.chain The Distinguished Name (DN) list hints of the CA certificates will be sent to clients. If omitted, will not send any DN list to clients.

Phases

  • certificate

Parameters

  • ca_certs (cdata, optional): The CA certificate chain opaque pointer

Returns

  1. true|nil: Returns true if successful, or nil if it fails.
  2. nil|err: Returns nil if successful, or an error message if it fails.

Usage

  1. local x509_lib = require "resty.openssl.x509"
  2. local chain_lib = require "resty.openssl.x509.chain"
  3. local res, err
  4. local chain = chain_lib.new()
  5. -- err check
  6. local x509, err = x509_lib.new(pem_cert, "PEM")
  7. -- err check
  8. res, err = chain:add(x509)
  9. -- err check
  10. -- `chain.ctx` is the raw data of the chain, i.e. `STACK_OF(X509) *`
  11. res, err = kong.client.tls.request_client_certificate(chain.ctx)
  12. if not res then
  13.   -- do something with err
  14. end

kong.client.tls.disable_session_reuse()

Prevents the TLS session for the current connection from being reused by disabling the session ticket and session ID for the current TLS connection.

Phases

  • certificate

Returns

  1. true|nil: Returns true if successful, nil if it fails.

  2. nil|err: Returns nil if successful, or an error message if it fails.

Usage

  1. local res, err = kong.client.tls.disable_session_reuse()
  2. if not res then
  3.   -- do something with err
  4. end

kong.client.tls.get_full_client_certificate_chain()

Returns the PEM encoded downstream client certificate chain with the client certificate at the top and intermediate certificates (if any) at the bottom.

Phases

  • rewrite, access, balancer, header_filter, body_filter, log

Returns

  1. string|nil: Returns a PEM-encoded client certificate if the mTLS handshake was completed, or nil if an error occurred or the client did not present its certificate.

  2. nil|err: Returns nil if successful, or an error message if it fails.

Usage

  1. local cert, err = kong.client.get_full_client_certificate_chain()
  2. if err then
  3.   -- do something with err
  4. end
  6. if not cert then
  7.   -- client did not complete mTLS
  8. end
  10. -- do something with cert

kong.client.tls.set_client_verify()

Overrides the client’s verification result generated by the log serializer.

By default, the request.tls.client_verify field inside the log generated by Kong’s log serializer is the same as the $ssl_client_verify Nginx variable.

Only "SUCCESS", "NONE", or "FAILED:<reason>" are accepted values.

This function does not return anything on success, and throws a Lua error in case of a failure.

Phases

  • rewrite, access, balancer

Usage

  1. kong.client.tls.set_client_verify("FAILED:unknown CA")