Configuration

configobjectrequired
Hide Child Parameters
allow_partial_chainboolean

Allow certificate verification with only an intermediate certificate. When this is enabled, you don’t need to upload the full chain to Kong Certificates.

Default:false

anonymousstring

An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure 4xx. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

authenticated_group_bystring

Certificate property to use as the authenticated group. Valid values are CN (Common Name) or DN (Distinguished Name). Once skip_consumer_lookup is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.

Allowed values:CNDN

Default:CN

ca_certificatesarray[string]required

List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (id).

cache_ttlnumber

Cache expiry time in seconds.

Default:60

cert_cache_ttlnumber

The length of time in milliseconds between refreshes of the revocation check status cache.

Default:60000

certificate_header_formatstringrequired

Format of the certificate header. Supported formats: base64_encoded, url_encoded.

Allowed values:base64_encodedurl_encoded

certificate_header_namestringrequired

Name of the header that contains the certificate, received from the WAF or other L7 downstream proxy.

consumer_byarray[string]

Whether to match the subject name of the client-supplied certificate against consumer’s username and/or custom_id attribute. If set to [] (the empty array), then auto-matching is disabled.

Allowed values:custom_idusername

Default:custom_id, username

default_consumerstring

The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

http_proxy_hoststring

A string representing a host name, such as example.com.

http_proxy_portinteger

An integer representing a port number between 0 and 65535, inclusive.

>= 0<= 65535

http_timeoutnumber

HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.

Default:30000

https_proxy_hoststring

A string representing a host name, such as example.com.

https_proxy_portinteger

An integer representing a port number between 0 and 65535, inclusive.

>= 0<= 65535

revocation_check_modestring

Controls client certificate revocation check behavior. If set to SKIP, no revocation check is performed. If set to IGNORE_CA_ERROR, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn’t fail on network issues. If set to STRICT, the plugin only treats the certificate as valid when it’s able to verify the revocation status.

Allowed values:IGNORE_CA_ERRORSKIPSTRICT

Default:IGNORE_CA_ERROR

secure_sourceboolean

Whether to secure the source of the request. If set to true, the plugin will only allow requests from trusted IPs (configured by the trusted_ips config option).

Default:true

skip_consumer_lookupboolean

Skip consumer lookup once certificate is trusted against the configured CA list.

Default:false

protocolsarray[string]

A set of strings representing HTTP protocols.

Allowed values:grpcgrpcshttphttps

Default:grpc, grpcs, http, https

routeobject

If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.

* Additional properties are NOT allowed.
Hide Child Parameters
idstring
serviceobject

If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.

* Additional properties are NOT allowed.
Hide Child Parameters
idstring

Did this doc help?

Something wrong?

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!