Envoy代理HTTPS流量时加载pkcs12证书失败，请求排查配置问题

需求：使用Envoy作为HTTPS流量代理，从Java开发人员处获取了pkcs12格式证书（/etc/cert.p12），希望用户可通过8080端口无需证书访问Envoy，由Envoy转发请求至api.example.com:443。

已配置的envoy.yaml如下：

static_resources:
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: app
              domains:
              - "*"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: api-example-https
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
  - name: api-example-https
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: api-example-https
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: api.example.com
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          tls_certificates:
          - pkcs12:
              filename: /etc/cert.p12

启动Envoy时出现错误：

[2022-11-01 22:17:48.788][1][critical][main] [source/server/server.cc:117] error initializing configuration '/etc/envoy.yaml': Failed to load pkcs12 from /etc/cert.p12
[2022-11-01 22:17:48.788][1][info][main] [source/server/server.cc:961] exiting
Failed to load pkcs12 from /etc/cert.p12

排查3小时仍未解决，请问配置中遗漏了什么？

你的配置遗漏了PKCS12证书的密码配置，Java生成的PKCS12证书默认带密码保护，Envoy加载时必须指定密码才能读取证书内容。

修改后的clusters部分配置如下：

clusters:
  - name: api-example-https
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: api-example-https
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: api.example.com
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          tls_certificates:
          - pkcs12:
              filename: /etc/cert.p12
              password:
                inline_string: "你的证书密码" # 替换为实际的PKCS12证书密码

同时需要确认以下几点：

• 证书文件/etc/cert.p12的权限是否正确，Envoy进程需要具备读取权限，可执行chmod 644 /etc/cert.p12调整权限
• 证书密码是否准确，若不确定可联系Java开发人员确认
• Envoy版本是否支持PKCS12格式，建议使用1.18及以上版本

内容的提问来源于stack exchange，提问作者Abdennour TOUMI