{"id":20322588,"url":"https://github.com/budanm/envoy-with-2way-ssl","last_synced_at":"2026-05-08T11:42:02.001Z","repository":{"id":136094339,"uuid":"199040555","full_name":"budanm/Envoy-With-2way-SSL","owner":"budanm","description":"This example demonstrates the example for acheiving 2way ssl on both ingress ( inward traffic) as well as egress ( outward network traffic ) using Envoy","archived":false,"fork":false,"pushed_at":"2022-12-10T23:56:02.000Z","size":154,"stargazers_count":3,"open_issues_count":7,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-04T10:14:02.374Z","etag":null,"topics":["envoy-filter","envoy-proxy","envoyproxy","ssl","tls-connection","two-way-ssl-authentication"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/budanm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-26T15:28:35.000Z","updated_at":"2022-12-20T20:56:57.000Z","dependencies_parsed_at":null,"dependency_job_id":"c9bce70d-ff88-4b93-8793-168bc071b633","html_url":"https://github.com/budanm/Envoy-With-2way-SSL","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/budanm/Envoy-With-2way-SSL","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/budanm%2FEnvoy-With-2way-SSL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/budanm%2FEnvoy-With-2way-SSL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/budanm%2FEnvoy-With-2way-SSL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/budanm%2FEnvoy-With-2way-SSL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/budanm","download_url":"https://codeload.github.com/budanm/Envoy-With-2way-SSL/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/budanm%2FEnvoy-With-2way-SSL/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32779655,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"ssl_error","status_checked_at":"2026-05-08T08:22:45.650Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["envoy-filter","envoy-proxy","envoyproxy","ssl","tls-connection","two-way-ssl-authentication"],"created_at":"2024-11-14T19:23:42.811Z","updated_at":"2026-05-08T11:42:01.981Z","avatar_url":"https://github.com/budanm.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Envoy-With-2way-SSL\nThis example demonstrates the example for acheiving 2way ssl on both ingress ( inward traffic) as well as egress ( outward network traffic ) using Envoy\n\n\n### 2 WAY SSL\nIf you are not aware about how 2 way ssl works or how it is different from 1 way ssl . Please refer to this [article](https://tutorialspedia.com/an-overview-of-one-way-ssl-and-two-way-ssl/)\n### Generating self-signed certificates for 2way ssl ( Mutual  TLS )\nFor generating self-signed , I found this [link](https://blog.cloudboost.io/implementing-mutual-ssl-authentication-fc20ab2392b3) to be quiet helpful. Ensure however that the common name used for client/server certificate should be different from the common name used for the CA certificate\n\n\n## Description\nThis project is simply an extension of my previous project where I create getting started example on using Envoy as a load balancer. Please visit this [link](https://github.com/budanm/EnvoyLoadBalancer/) to have a look. \n\nHowever this project is a little bit different from the previous setup . Here tls context ( downstream tls context ) has been introduced in the edge envoy to carry out tls termination against downstream insecure traffic. Also one of node applications ( service 2 ) has been protected and hence the sidecar/service envoy for that application now handles the upstream tls context ( cluster upsteam tls context ).\nThe set up of the project can be described roughly in the diagram below\n\n![Envoy proxy mesh with 2 way ssl](envoy2wayssl.png?raw=true \"Deployment diagram\")\n\n\n## Instructions to run the project ( docker-compose )\n\nThe project comes with a docker-compose file which can be used as it is\n\nStep1: Build the project\n```\ndocker-compose build\n```\n\nStep2: Bring up the envoy containers using docker-compose\n```\ndocker-compose up  \n```\n\nStep3: Verify service 1 is up and running\n```\ncurl -k -v --cert front-envoy-proxy/certificates/clientB-crt.pem --key front-envoy-proxy/certificates/clientB-key.pem https://localhost:8443/service/1\n\nExpected response : TLS Handhake steps  + Hello I am a simple express api service 1 with a sidecar envoy proxy and I am unprotected\n```\n\nStep4: Verify service 2 is up and running\n```\ncurl -k -v --cert front-envoy-proxy/certificates/clientB-crt.pem --key front-envoy-proxy/certificates/clientB-key.pem https://localhost:8443/service/2\n \nExpected response : TLS Handshake steps +  Hello I am a simple express api service 2 with a sidecar envoy proxy attached and I am protected\n```\n\nStep5: Verify service 3 is up and running\n```\ncurl -k -v --cert front-envoy-proxy/certificates/clientB-crt.pem --key front-envoy-proxy/certificates/clientB-key.pem https://localhost:8443/service/3\n \nExpected response : TLS Handshake steps +  Hello I am a simple standalone express api service 3 and I am protected\n```\n\nThe reason for using -k option with curl is because of the reason mentioned in their manuals as shown below\n-k/--insecure\n\n(SSL) This option explicitly allows curl to perform \"insecure\" SSL connections and transfers. Starting with curl 7.10, all SSL connections will be attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered \"insecure\" to fail unless -k/--insecure is used.\n\nThe certificates I have used in this project are self signed and hence it will not work with the --cacert option\n\n## Modification avenues for the project\nIf needed you can make changes to the service code and build the dockerfile using your own tag . You can even build your own certificates if you want using the CA certificate bundle installed by default\n\n## Built With\n\n* [Express](https://expressjs.com/) - The framework used for developing simple services ( service1 and service 2 )\n\n \n\n## Authors\n\n* **Soumya Mukhopadhyay** \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbudanm%2Fenvoy-with-2way-ssl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbudanm%2Fenvoy-with-2way-ssl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbudanm%2Fenvoy-with-2way-ssl/lists"}