You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "cybersec-jochenarnold (via GitHub)" <gi...@apache.org> on 2026/02/13 15:35:11 UTC

[I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

cybersec-jochenarnold opened a new issue, #13013:
URL: https://github.com/apache/apisix/issues/13013

   ### Current Behavior
   
   Using mTLS for Upstream with $env:// for Certificate and Private Key.
   
   ### Expected Behavior
   
   Using nginx env variable should be working for secrets like private key.
   
   ### Error Logs
   
   ssl.lua:162: aes_decrypt_pkey(): base64 decode ssl key failed. key[$env://API_UPSTREAM_KEY] ...
   
   ### Steps to Reproduce
   
   1. Run APISIX binary on Ubuntu
   2. Create Service with Upstream and refer to a SSL ID
   3. Create SSL with type=client
   
   ssls:
     - id: "UPSTREAM_CLIENT_CERT_ID"
       certificates:
         - certificate: "$env://API_UPSTREAM_CERT"
           key: "$env://API_UPSTREAM_KEY"
       snis:
         - "example.com"
       ssl_protocols:
         - TLSv1.2
         - TLSv1.3
       type: client
   
   ### Environment
   
   - APISIX version (run `apisix version`): 3.15.0
   - Operating system (run `uname -a`): Ubuntu
   - OpenResty / Nginx version (run `openresty -V` or `nginx -V`): openresty/1.27.1.2
   - etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`): -
   - APISIX Dashboard version, if relevant: not used
   - Plugin runner version, for issues related to plugin runners: -
   - LuaRocks version, for installation issues (run `luarocks --version`): -
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3900409384

   Hi @cybersec-jochenarnold, could you provide the configuration information for the service?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3901239139

   The code at https://github.com/apache/apisix/blob/master/apisix/init.lua#L557 directly uses `api_ctx.upstream_ssl = upstream_ssl`, without calling `secret.fetch_secrets` to resolve environment variables and key references as in server-side SSL processing. This part of the logic needs to be improved by submitting code.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "cybersec-jochenarnold (via GitHub)" <gi...@apache.org>.
cybersec-jochenarnold commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3901204199

   Hi @Baoyuantop ,
   
   of course, I have added my service configuration.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "Satish11012007 (via GitHub)" <gi...@apache.org>.
Satish11012007 commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3901303879

   Hi @Baoyuantop, @cybersec-jochenarnold
   
   I’ve been looking into this issue and reviewing the relevant code in init.lua. It appears that when router_ssl.get_by_id() loads the upstream SSL object, it is directly assigned to api_ctx.upstream_ssl without going through secret.fetch_secrets().
   
   Because of that, references such as $env://API_UPSTREAM_KEY are not resolved before key processing, which results in the base64 decode failure during aes_decrypt_pkey().
   
   If this issue is not already being worked on, I would be glad to explore a potential improvement by aligning the upstream SSL handling with the existing server-side secret resolution flow.
   
   Please let me know if it would be appropriate for me to proceed with a draft fix.
   
   Thank you for your guidance.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "cybersec-jochenarnold (via GitHub)" <gi...@apache.org>.
cybersec-jochenarnold commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3901273700

   I'm happy to do that.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "cybersec-jochenarnold (via GitHub)" <gi...@apache.org>.
cybersec-jochenarnold commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3901349963

   Hi @Satish11012007 ,
   
   I'm still unsure, as I would of course like to contribute something. However, I first need to set up the build development environment. But I would still like to try.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "cybersec-jochenarnold (via GitHub)" <gi...@apache.org>.
cybersec-jochenarnold commented on issue #13013:
URL: https://github.com/apache/apisix/issues/13013#issuecomment-3906706016

   Fixes including test cases have been implemented. I will now deploy it in a test environment and (if successful) create the PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] bug: nginx env variable for private key is not resolved in upstream with mtls [apisix]

Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan closed issue #13013: bug: nginx env variable for private key is not resolved in upstream with mtls
URL: https://github.com/apache/apisix/issues/13013


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org