Google Cloud负载均衡器基于PrivateCA的mTLS配置失败求助

我在Google Cloud全球HTTPS负载均衡器上配置mTLS时，客户端连接始终被拒绝，报错client_cert_validation_failed。我严格按照官方步骤操作，但信任配置（trust config）似乎未生效。

信任配置 #

trustStores:
- trustAnchors:
  - pemCertificate: |
      -----BEGIN CERTIFICATE-----
      MIICWzCCAgKgAwIBAgIUANxN5VlXyQgGZp4uZJi7iXnIivEwCgYIKoZIzj0EAwIw
      [...]
      SM49BAMCA0cAMEQCIBmn2170sahTzA0iBYuULNeywX+r8fX8JucglsMQNBT8AiAP
      vJwqN9I7bmTgItfpjozMIExZiSeiTn45TfEdNLNsTQ==
      -----END CERTIFICATE-----

注意：PEM格式绝对正确。

TLS策略配置 #

执行查询命令：

gcloud beta network-security server-tls-policies describe london-ips-tls-policy --location=global 

返回的策略详情：

createTime: '2023-08-22T15:59:51.030272533Z'
mtlsPolicy:
  clientValidationMode: REJECT_INVALID
  clientValidationTrustConfig: projects/MY_PROJECT_NUM/locations/global/trustConfigs/london-ips-trust-config
name: projects/MY_PROJECT_ID/locations/global/serverTlsPolicies/london-ips-tls-policy
updateTime: '2023-08-22T16:28:04.303764856Z'

Target HTTPS Proxy配置 #

# ...
serverTlsPolicy: //networksecurity.googleapis.com/projects/MY_PROJECT_ID/locations/global/serverTlsPolicies/london-ips-tls-policy

客户端测试情况 #

使用已批准的客户端证书发起请求：

-----BEGIN CERTIFICATE-----
MIIDWzCCAwKgAwIBAgIUAKpLh7uR2I/q21WKu84Sg5VZadowCgYIKoZIzj0EAwIw
[...]
kC2s86eKXEhjU4t22QIgOHZaPGUzO3Zr9m1esHYn8T+cnSEZPaYaXigSxlil6cg=
-----END CERTIFICATE-----

Go测试代码：

// load key/cert pair
clientCertForTls, err := tls.LoadX509KeyPair(os.ExpandEnv(*clientCertPath), os.ExpandEnv(*privateKeyPath))
if err != nil {
    log.Fatalf("unable to load x509 pair, %v", err)
}

// http client with client certs
mTLSClient := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            ClientAuth:   tls.RequestClientCert,
            Certificates: []tls.Certificate{clientCertForTls},
        },
    },
}

// make request
resp, err := mTLSClient.Get("https://OUR_URL.com/")
if err != nil {
    log.Fatalf("unable to mtls ips, %v", err)
}
bodyDat, _ := io.ReadAll(resp.Body)
log.Printf("body: %s", bodyDat)
for k := range resp.Header {
    log.Printf("header[%s]: %s", k, resp.Header.Get(k))
}
if resp.StatusCode != http.StatusOK {
    log.Fatalf("failed to mtls ips, %s: %s", resp.Status)
} else {
    log.Printf("ALL GOOD! :)")
}

日志报错信息 #

使用日志查询语句：

jsonPayload.@type="type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry"

得到的拒绝日志内容：

{
httpRequest: {
latency: "0s"
remoteIp: "REDACTED"
}
insertId: "REDACTED"
jsonPayload: {
@type: "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry"
backendTargetProjectNumber: "projects/MY_PROJECT_NUM"
remoteIp: "REDACTED"
statusDetails: "client_cert_validation_failed"
}
logName: "projects/MY_PROJECT_ID/logs/requests"
receiveTimestamp: "2023-08-22T17:00:55.441451401Z"
resource: {
labels: {
backend_service_name: ""
forwarding_rule_name: "lb-frontend-acme-protected"
project_id: "MY_PROJECT_ID"
target_proxy_name: ""
url_map_name: ""
zone: "global"
}
type: "http_load_balancer"
}
severity: "INFO"
timestamp: "2023-08-22T17:00:54.413317Z"
}

额外测试说明 #

将clientValidationMode改为ALLOW_INVALID_OR_MISSING_CLIENT_CERT后，流量可正常通过，说明负载均衡器在拒绝由已配置根CA签发的合法客户端证书。

更新：使用cURL测试同样出现连接重置，命令如下：

curl --key ~/.vipro-key.pem --cert ~/Downloads/client-cert.crt -v https://OUR_PROTECTED_ENDPOINT/

内容的提问来源于stack exchange，提问作者Tom Medhurst