verifyCertificateHash not working when using server certificates and CA certificate
Author: lajansaaaCreated Sep 17, 2026Updated Sep 17, 2026
Is this the right place to submit this?
- This is not a security vulnerability or a crashing bug
- This is not a question about how to use Istio
Bug Description
Tried to whitelist client cert hashes by specifying verifyCertificateHash. When trying to hit istio using a non-whitelisted client cert, the request was not blocked by istio gateway.
- hosts:
- example.mtls.com
tls:
mode: MUTUAL
privateKey: /vault/secrets/tls.key
serverCertificate: /vault/secrets/tls.crt
caCertificates: /vault/secrets/mtls.crt
verifyCertificateHash:
- <hash1>
- <hash2>Ran istioctl proxy-config listener <istio-ingress-gateway-pod> -o json > listener_file.yaml shows that defaultValidationContext is empty.
"combinedValidationContext": {
"defaultValidationContext": {},
"validationContextSdsSecretConfig": {
"name": "file-root:/vault/secrets/mtls.crt",
"sdsConfig": {
"apiConfigSource": {
"apiType": "GRPC",
"transportApiVersion": "V3",
"grpcServices": [
{
"envoyGrpc": {
"clusterName": "sds-grpc"
}
}
],
"setNodeOnFirstMessageOnly": true
},
"resourceApiVersion": "V3"
}
}
}When I used credentialName instead,
- hosts:
- example.mtls.com
tls:
mode: MUTUAL
credentialName: test-tls-secrets-cacert
verifyCertificateHash:
- <hash1>
- <hash2>I see verifyCertificateHash in the listener output.
"combinedValidationContext": {
"defaultValidationContext": {
"verifyCertificateHash": [
"<hash1>",
"<hash2>"
]
},
"validationContextSdsSecretConfig": {
"name": "kubernetes://test-tls-secrets-cacert",
"sdsConfig": {
"ads": {},
"resourceApiVersion": "V3"
}
}
}Is verifyCertificateHash only supported for credentialName?
Version
client version: 1.31.0
control plane version: 1.30.3
data plane version: 1.30.3 (26 proxies)Additional Information
No response
Source: istio/istio