feat(cloudflare): add cloudflare-mode option to choose which store to upload cert - #54
Open
claneys wants to merge 4 commits into
Open
feat(cloudflare): add cloudflare-mode option to choose which store to upload cert#54claneys wants to merge 4 commits into
claneys wants to merge 4 commits into
Conversation
Some CA bundles are rejected by Cloudflare's custom_certificates trust
store validation ("certificate chain cannot be bundled"). Add a
per-secret leaf-only annotation to upload only the leaf certificate
instead of the full chain.
The custom_certificates endpoint uploads edge certificates, which Cloudflare bundles against its public trust store. Syncing an origin mTLS client certificate issued by an internal CA there always fails with "certificate chain cannot be bundled using Cloudflare's trust store", whether or not the CA is included. Add a cloudflare-mode annotation selecting the target store. "origin-pull" uses the origin_tls_client_auth endpoint, which is the one meant for client certificates Cloudflare presents to the origin: it takes the leaf and the private key only, and accepts a private issuing CA. That endpoint has no update method, so a renewal uploads the new certificate and removes the one it replaced. Replaces the leaf-only flag, which could not fix this: a leaf issued by a private CA is rejected by custom_certificates all the same.
claneys
changed the title
The origin-pull mode uploads a zone-level client certificate, which applies to every hostname in the zone. Zones that need a different client certificate per hostname have no way to express that. Add an origin-pull-hostname mode that uploads to the per-hostname endpoint and associates the certificate with the hostnames listed in a new cloudflare-hostnames annotation. Associating a hostname is what puts the certificate in use, so it runs before the replaced certificate is removed; if the association fails, the freshly uploaded certificate is deleted so retries do not pile up unused certificates. Both mode and hostnames are validated together: the mode requires a non-empty list, and the list is rejected in any other mode rather than being silently ignored.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The certificate was being pushed to Cloudflare's custom_certificates endpoint, which holds edge certificates served to visitors and requires a chain Cloudflare can bundle against its public trust store. Ours is issued by the internal ca, so every sync failed with "certificate chain cannot be bundled using Cloudflare's trust store" — dropping the CA from the payload did not help, since the leaf itself is privately issued.
Fix errors 2100: