TLS settings verification

[rmessana-d]

Hello,

I am being asked by my security team to answer the following questions

1. Screenshot showing communication among pods within the Kubernetes is automatically encrypted using mutual TLS provided (using 1.2),
2. Evidence showing that certificates are rotated every 24-hours.

I deployed linkerd via the YAML provided by linkerd 2.7.1 cli using a vanilla configuration. Where can I find evidence of the above two questions within the YAML config?

[grampelberg]

The docs explain how to do this =)

[rmessana-d]

Thank you for the quick reply. I see how I can verify TLS by using the linkerd tap command, however I am struggling to understand how I can show evidence of 24 hour rotation. Any help is appreciated.

[grampelberg]

I would recommend using openssl to fetch the certificate directly from the proxy you're trying to validate.

This command would work with emojivoto:

openssl s_client -servername default.emojivoto.serviceaccount.identity.linkerd.cluster.local -connect localhost:4191 2>/dev/null | \
    openssl x509 -text