Certificate verification doesn't support intermediate CA chains about haproxy-consul-connect

[ShimmerGlass]

@banks what's the advantage of doing the TLS validation in the Connect code? Could we let HAProxy do the verification and just use the client certificate to get the client URI and validate the intentions?

[banks]

That's possible. Envoy sidecars validate the certificate before the AuthZ callback for example. Also assuming

• that HAProxy will load intermediates that are bundled with the client cert of the connection as described above (pretty sure this is standard usage but worth noting to test)
• that HAProxy will be configured with all the intermediates as well as just the root certs in the trust bundle

Originally I assumed that there was a good reason to do validation here so was just pointing out how to do it correctly, but if HAProxy can do it first before making the SPOE call then that's great.

[ShimmerGlass]

Thank you, I had the impression that for Envoy the certificate validation was done on the consul connect but it looks like I was mistaken.