Why the intermediate CA certificates are not allowed in "provided" CA?

[ryysud]

Summary

Why the intermediate CA certificates are not allowed in "provided" CA?
https://kuma.io/docs/0.5.0/policies/mutual-tls/#usage-of-provided-ca

I found a comment like Envoy constraint in the code and I want to know more about it.
https://github.com/Kong/kuma/blob/0.5.0/pkg/plugins/ca/provided/ca_cert_validator.go#L33-L35

[nickolaev]

Envoy has this pretty old issue, which apparently is still relevant: envoyproxy/envoy#1220. I think it gives a good explanation, especially the last couple of comments.

Then there was this user sharing their experience: envoyproxy/envoy#2675 I am sure there is more info around the internet.

Does that help you with your question?

[ryysud]

That is very helpful for me. Thank you.

[jakubdyszkiewicz]

Revisit intermediate CA support

[nikita15p]

+1 to this issue