feat: set default value of ssl_trusted_certificate to system

apisix/cli/config.lua

@@ -67,7 +67,8 @@ local _M = {
         "ECDHE-ECDSA-CHACHA20-POLY1305", "ECDHE-RSA-CHACHA20-POLY1305",
         "DHE-RSA-AES128-GCM-SHA256", "DHE-RSA-AES256-GCM-SHA384",
       }, ":"),
-      ssl_session_tickets = false
+      ssl_session_tickets = false,
+      ssl_trusted_certificate = "system"
     },
     enable_control = true,
     disable_sync_configuration_during_start = false,

apisix/cli/ops.lua

@@ -49,8 +49,6 @@ local str_find = string.find
 local str_byte = string.byte
 local str_sub = string.sub
 local str_format = string.format
-local string = string
-local table = table
 
 
 local _M = {}
@@ -503,38 +501,24 @@ Please modify "admin_key" in conf/config.yaml .
     yaml_conf.apisix.ssl.listen = ssl_listen
     yaml_conf.apisix.enable_http3_in_server_context = enable_http3_in_server_context
 
-
-    if yaml_conf.apisix.ssl.ssl_trusted_certificate ~= nil then
-        local cert_paths = {}
-        local ssl_certificates = yaml_conf.apisix.ssl.ssl_trusted_certificate
-        for cert_path in string.gmatch(ssl_certificates, '([^,]+)') do
-            cert_path = util.trim(cert_path)
-            if cert_path == "system" then
-                local trusted_certs_path, err = util.get_system_trusted_certs_filepath()
-                if not trusted_certs_path then
-                    util.die(err)
-                end
-                table.insert(cert_paths, trusted_certs_path)
-            else
-                -- During validation, the path is relative to PWD
-                -- When Nginx starts, the path is relative to conf
-                -- Therefore we need to check the absolute version instead
-                cert_path = pl_path.abspath(cert_path)
-                if not pl_path.exists(cert_path) then
-                    util.die("certificate path", cert_path, "doesn't exist\n")
-                end
-
-                table.insert(cert_paths, cert_path)
-            end
+    if yaml_conf.apisix.ssl.ssl_trusted_certificate == "system" then
+        local trusted_certs_path, err = util.get_system_trusted_certs_filepath()
+        if not trusted_certs_path then
+            util.die(err)
         end
-
-        local combined_cert_filepath = yaml_conf.apisix.ssl.ssl_trusted_combined_path
-                                       or "/usr/local/apisix/conf/ssl_trusted_combined.pem"
-        util.gen_trusted_certs_combined_file(combined_cert_filepath, cert_paths)
-
-        yaml_conf.apisix.ssl.ssl_trusted_certificate = combined_cert_filepath
+        yaml_conf.apisix.ssl.ssl_trusted_certificate = trusted_certs_path
+    else
+        -- During validation, the path is relative to PWD
+        -- When Nginx starts, the path is relative to conf
+        -- Therefore we need to check the absolute version instead
+        local cert_path = pl_path.abspath(yaml_conf.apisix.ssl.ssl_trusted_certificate)
+        if not pl_path.exists(cert_path) then
+            util.die("certificate path", cert_path, "doesn't exist\n")
+        end
+        yaml_conf.apisix.ssl.ssl_trusted_certificate = cert_path
     end
 
+
     -- enable ssl with place holder crt&key
     yaml_conf.apisix.ssl.ssl_cert = "cert/ssl_PLACE_HOLDER.crt"
     yaml_conf.apisix.ssl.ssl_cert_key = "cert/ssl_PLACE_HOLDER.key"

apisix/cli/schema.lua

@@ -209,9 +209,6 @@ local config_schema = {
                         ssl_trusted_certificate = {
                             type = "string",
                         },
-                        ssl_trusted_combined_path = {
-                            type = "string",
-                        },
                         listen = {
                             type = "array",
                             items = {

conf/config.yaml.example

@@ -99,9 +99,7 @@ apisix:
       # - ip: 127.0.0.3                           # If not set, default to `0.0.0.0`.
       #   port: 9445
       #   enable_http3: true
-    ssl_trusted_combined_path: /usr/local/apisix/conf/ssl_trusted_combined.pem # All the trusted certificates will be combined into a single file
-    #ssl_trusted_certificate: system              # Specifies comma separated list of trusted CA. Value can be either "system"(for using system available ca certs) or
-                                                # a file path with trusted CA certificates in the PEM format
+    #ssl_trusted_certificate: system              # Specifies a file path with trusted CA certificates in the PEM format. The default value is "system".
     ssl_protocols: TLSv1.2 TLSv1.3                # TLS versions supported.
     ssl_ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
     ssl_session_tickets: false  # If true, session tickets are used for SSL/TLS connections.

t/cli/test_stream_config.sh

@@ -74,26 +74,6 @@ fi
 
 echo "passed: enable stream proxy and http proxy"
 
-echo "
-apisix:
-    ssl:
-        ssl_trusted_certificate: t/certs/mtls_ca.crt
-        ssl_trusted_combined_path: t/certs/mtls_ca_combined.crt
-    proxy_mode: http&stream
-    stream_proxy:
-        tcp:
-            - addr: 9100
-" > conf/config.yaml
-
-make init
-
-if ! grep "t/certs/mtls_ca_combined.crt;" conf/nginx.conf > /dev/null; then
-    echo "failed: failed to set trust certificate"
-    exit 1
-fi
-
-echo "passed: set trust certificate"
-
 echo "
 apisix:
     proxy_mode: http&stream

t/cli/test_upstream_mtls.sh

@@ -155,7 +155,7 @@ echo "passed: when proxy_ssl_verify is enabled and ssl_trusted_certificate is wr
 echo '
 apisix:
   ssl:
-    ssl_trusted_certificate: system, t/certs/apisix.crt
+    ssl_trusted_certificate: t/certs/apisix.crt
 nginx_config:
   http_configuration_snippet: |
     server {

t/core/config_etcd.t

@@ -59,8 +59,6 @@ qr/(connection refused){1,}/
 --- yaml_config
 apisix:
   node_listen: 1984
-  ssl:
-    ssl_trusted_combined_path: t/servroot/conf/cert/etcd.pem
 deployment:
   role: traditional
   role_traditional: