TLS Metadata Headers Configuration

Configuration

This plugin is compatible with DB-less mode.

Compatible protocols

The TLS Metadata Headers plugin is compatible with the following protocols:

https, grpcs, tls

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name

  string required

  The name of the plugin, in this case tls-metadata-headers.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example tls-metadata-headers_my-service. Useful when running the same plugin in multiple contexts, for example, on multiple services.

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/SERVICE_NAME|SERVICE_ID/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/ROUTE_NAME|ROUTE_ID/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • inject_client_cert_details

    boolean default: false

    Enables TLS client certificate metadata values to be injected into HTTP headers.

  • client_cert_header_name

    string required default: X-Client-Cert

    Define the HTTP header name used for the PEM format URL encoded client certificate.

  • client_serial_header_name

    string required default: X-Client-Cert-Serial

    Define the HTTP header name used for the serial number of the client certificate.

  • client_cert_issuer_dn_header_name

    string required default: X-Client-Cert-Issuer-DN

    Define the HTTP header name used for the issuer DN of the client certificate.

  • client_cert_subject_dn_header_name

    string required default: X-Client-Cert-Subject-DN

    Define the HTTP header name used for the subject DN of the client certificate.

  • client_cert_fingerprint_header_name

    string required default: X-Client-Cert-Fingerprint

    Define the HTTP header name used for the SHA1 fingerprint of the client certificate.