Add an SDS server that mints a short-lived leaf per SNI on demand at handshake time

[haiyanmeng]

The traffic from an actor is sent to the egress gateway, Envoy, through atunnel egress, an HTTP CONNECT tunnel. To allow Envoy to inspect the HTTP headers of egress traffic, we plan to introduce an SDS server that mints a short-lived leaf per SNI on demand at handshake time, sdsmintd.

[Stevenjin8]

I'll just say that this would require some application level changes, notably, nodejs uses a bundled set of CAs, rather than discovering them from /etc/certs or whatever

[EItanya]

I'll just say that this would require some application level changes, notably, nodejs uses a bundled set of CAs, rather than discovering them from /etc/certs or whatever

It will depend on the application. Most codebases/applications follow some wellknown folders and/or env vars, but there are of course some that won't.