Summary
The Gateway currently serves a static pre-provisioned certificate for every downstream handshake, so it can only present identities the operator (e.g. Helm) baked into that certificate's SANs.
Requirements
The Gateway should support minting short-lived leaf certificates on demand from an operator-provided CA, so any resource address (Web App hostnames, Kubernetes API endpoints) gets a matching certificate without re-issuing the gateway certificate.
- Restructure the
tls config into two mutually exclusive modes: tls.static (the existing certificateFile/privateKeyFile pair, hard-moved under static) and tls.dynamic; exactly one must be set, enforced by config validation. This is a breaking config schema change (feat!:).
tls.dynamic takes a signing CA (ca.selfSign with certificateFile + privateKeyFile) and optional leaf settings (cert.duration, cert.renewBefore, cert.keyType, cert.keyBits; defaults 24h / 8h / ecdsa / 256).- In dynamic mode every downstream handshake presents a minted certificate: the inner post-CONNECT upgrade mints for the CONNECT-validated downstream host (before any alias rewrite), and pre-CONNECT/health handshakes mint from SNI, falling back to the connection's local IP. Leaves are cached per host and re-minted inside the
renewBefore window, backdated 5m for clock skew.
- Static mode behaves exactly as today (including certificate hot-reload); the Helm chart emits
tls.static.
Summary
The Gateway currently serves a static pre-provisioned certificate for every downstream handshake, so it can only present identities the operator (e.g. Helm) baked into that certificate's SANs.
Requirements
The Gateway should support minting short-lived leaf certificates on demand from an operator-provided CA, so any resource address (Web App hostnames, Kubernetes API endpoints) gets a matching certificate without re-issuing the gateway certificate.
tlsconfig into two mutually exclusive modes:tls.static(the existingcertificateFile/privateKeyFilepair, hard-moved understatic) andtls.dynamic; exactly one must be set, enforced by config validation. This is a breaking config schema change (feat!:).tls.dynamictakes a signing CA (ca.selfSignwithcertificateFile+privateKeyFile) and optional leaf settings (cert.duration,cert.renewBefore,cert.keyType,cert.keyBits; defaults 24h / 8h / ecdsa / 256).renewBeforewindow, backdated 5m for clock skew.tls.static.