Implement two way SSL

[mogronalol]

Proposed solution for this is to allow Hoverfly to be configurable with a client certificate to use with two way SSL.

It will then be up to the end user to decide on whether to generate a new client certificate for Hoverfly, or re-use an existing client certificate. The former is most likely to be used as it means avoiding sharing of private keys between existing clients and Hoverfly, but also means that the server will have to be configured to trust the new certificate used by Hoverfly.

[sarathchand09]

Could you please tell me how to do the ssl config in hoverfly, how do we configure client certificates in hoverfly for oneway or 2 way ssl

[mogronalol]

SSL setup information is available in the docs here

[sarathchand09]

Thanks, is two way-ssl already implemented? or still under development for hoverfly

[Osipion]

Hey. I'd like an update on this - is it implemented yet @mogronalol? Looks like it was removed from the delivery milestones for last year. However, we are also unable to use Hoverfly without two-way SSL

[mogronalol]

Unfortunately, this has fallen behind due to the development of our cloud offering. It can be put back on our roadmap but it will likely not be implemented in the immediate future.

[JohnFDavenport]

@Osipion @sarathchand09 We'd be interested in learning more about your requirements.

If you prefer to, feel free to contact us directly.

[Osipion]

@JohnFDavenport OK, so I can't talk about specific tech beyond the development OS (OS X), Docker, and Hoverfly, but I might have an architecture something like this

        [Device]
           | 1 
         [API]
    |2     |2      |2
   [A]    [B]     [C]

Where A, B and C are HTTP services the API consumes. All connections (1 & 2) use two-way pinned SSL (I have the cert and key). The server expects clients to present a certificate, and the client expects the server to present a pinned certificate.

I have two main use cases:

Dev:

During development, I want to deploy the API to a docker container. It will consume services (e.g. A, B and C) from an existing test environment. Although I can control whether our client and API use two way SSL during dev, I can't control whether the services the API talks to do. As we are not developing on Linux, a container can't easily talk to a hoverfly instance on the host, so I deploy hoverfly into the container with the API. The client device runs on the host, and is proxied (at connection 1) through an exposed port on the container to the hoverfly instance and on into the API in the same container. The API then proxies its service requests through the containerized hoverfly instance as well (at connection 2). This allows us to modify/simulate traffic as well as logging traffic to a database for debugging/testing. It also means that I'm hoping a single hoverfly instance can mitm two pinned ssl connections (they may use the same cert, I need to check this).

Integration/Perfomance Testing

During integration and performance testing, we want a mock that can be used to process requests at scale with reliable performance. We want to be able to use the same mocks as we do during Dev, but without middleware.

This may lead to a second problem - we also want to mock only some service paths, but we want all requests to go through some middleware. There doesn't seem to be a way for the middleware to choose to invoke either a pass-through to the real destination [without having to re-dispatch the request itself] or send it on to the hoverfly simulation engine. Hoverfly provides lots of useful functionality, but the middleware doesn't seem to have direct access to it. Instead of always returning a payload, maybe middleware could be allowed [perhaps in a specific mode], to return a json object with a command like { "action": "simulate"}? For another issue probably.

[stkac55]

Just following up on this. It appears this is not yet available? Is there any timeframe for the development of this? The requirements for us would be more similar to the dev scenario mentioned above with most connections utilizing two way SSL.

[balajicv]

@mogronalol any updates on prioritizing this ?