Listens on tls port 23456 and will echo back whatever is sent to the server.
- docker compose
- openssl
To start the Docker Compose stack defined in the compose.yaml file, use:
docker compose up -dopenssl s_client -connect localhost:23456 -CAfile test-ca.crt -quiet -alpn echooutput:
depth=1 C = US, ST = California, L = Palo Alto, O = Aklivity, OU = Development, CN = Test CA
verify return:1
depth=0 C = US, ST = California, L = Palo Alto, O = Aklivity, OU = Development, CN = localhost
verify return:1
Type a Hello, world message and press enter.
output:
Hello, world
Hello, world
The secure-echo application protocol is routed only when the x509 guard authorizes
the session from the client certificate presented during the handshake. Mutual TLS is
requested, not required, so the echo protocol above keeps working with no client
certificate at all.
Without a client certificate the handshake still completes, but the guarded route does not authorize and no application stream is opened:
openssl s_client -connect localhost:23456 -CAfile test-ca.crt -quiet -alpn secure-echoBoth Test Client CA and Test Other CA are trusted by the server, so a certificate
signed by either one completes the handshake. Only Test Client CA is named by the
guard's client role, so a certificate from the other issuer is authenticated at the
transport layer yet still refused by the route:
openssl s_client -connect localhost:23456 -CAfile test-ca.crt -cert other.crt -key other.key -quiet -alpn secure-echoA certificate from the named issuer authorizes the route, and the echo succeeds:
openssl s_client -connect localhost:23456 -CAfile test-ca.crt -cert client.crt -key client.key -quiet -alpn secure-echoType a Hello, world message and press enter.
output:
Hello, world
Hello, world
The only difference between the last two commands is which certificate is presented, so the guard reading that certificate is what decides whether the route authorizes.
To remove any resources created by the Docker Compose stack, use:
docker compose down