pomerium / pomerium / 5836770992

45%

push

github

config: support client certificate SAN match (#4453)

Add a new match_subject_alt_names option to the downstream_mtls settings
group. This setting can be used to further constrain the allowed client
certificates by requiring that certificates contain a Subject
Alternative Name of a particular type, matching a particular regex.

When set, populate the corresponding match_typed_subject_alt_names
setting within Envoy, and also implement a corresponding check in the
authorize service.

126 of 126 new or added lines in 5 files covered. (100.0%)

14188 of 22172 relevant lines covered (63.99%)

119.1 hits per line