Does Fabio support multiple CS Stores per listener?

[far-blue]

Hi all,

Does Fabio support multiple 'cs' stores on a single listener? I have a mix of services, some with paid-for certs and others needing self-signed certs and I'd like to auto-generate the self-signed certs via Vault. As a result, I'd need to be able to support something like Vault (non-pki) or consul for the paid-for certs and then fall back to the vault-pki store to generate certs for other services.

[pschultz]

No, that is not possible. If you know which certificates you need ahead of time you can of course generate them independently of fabio and store them all in Vault's KV engine. If you don't know ahead of time you have to find a way to run two listeners (perhaps with a simple proxy in front of fabio that picks the appropriate listener).

If this was possible, how would you want fabio to choose which certificate store to use for any given request?

[far-blue]

Thanks for the info - I suspected as much. I'm also assuming that vault k/v and vault-pki are treated as 2 different types of cs store so I basically can't use vault-pki (where vault auto-generates certs) alongside hand-managed certs.

If multiple stores were supported I'd expect them to be tried in the order they are listed on the proxy.addr configuration. Each would be tried in turn until a cert was found. I guess the only caveat would be that if a cert was found in a manually managed store but was expired it should still be served rather than falling back to something like the vault-autogen store.

[pschultz]

Trying sources in order was my intuition as well, but I didn't think this would be possible, because certificates are loaded asynchronously (i.e. we don't query Consul or Vault or whatever for every request).

Turn's out it wasn't that difficult after all. I pushed a proof of concept to the mux-cert-source branch.

If you could take this for a spin in a test environment that would be much appreciated. I don't have time to test this properly right now. I basically just made sure that it compiles and loads the config as expected. So really, don't put it in production :)

The config has to look something like this:

proxy.cs = cs=consul;type=consul;cert=secret/fabio/certs,cs=vault;type=vault-pki;cert=fabio-pki/issue/test,cs=mux;type=mux;cert=consul+vault
proxy.addr = localhost:9999;cs=mux

This gives the "consul" source precedence over the "vault" source.

Certificate expiration isn't taken into account (but simple to add later). If the POC works out I can polish it sometime next week and turn it into a PR.

[far-blue]

wow, cool!

I'll do my best to find some time to test and let you know :)

Thanks :)

[far-blue]

Sorry for the delay in testing this - it's still on my todo but with loads of staff on holiday I'm too focused on other stuff atm :(

[FredPraca]

Will the mux branch be merged one day ?
I'm facing the problem where I have a CS source which is a Vault PKI for a certain domain and a Vault CS for another domain but I don't know how to deal with this without having an upstream reverse proxy routing on two different fabio listening point.

[tristanmorgan]

Not quite a perfect solution but using a single listener with proto=https+tcp+sni allow certs from multiple sources. I have Vault issued certs combined with some TLS passthrough using their own cert sources. Not as pretty but the passthrough targets could terminate TLS with certificates from Vault.

If pschultz or someone else decides to polish the code into a PR it could be merged in the future.