docs: Clarify verify_certificate_hash docs (#612)

Signed-off-by: Joe Friedl <joseph.friedl@venmo.com>
7 years ago · c15104fce7
parent 045667483e
commit c15104fce7
1 changed files with 8 additions and 1 deletions
--- a/envoy/api/v2/auth/cert.proto
+++ b/envoy/api/v2/auth/cert.proto
@ -132,8 +132,15 @@ message CertificateValidationContext {
  // system CA locations.
  core.DataSource trusted_ca = 1;

-  // If specified, Envoy will verify (pin) the hex-encoded SHA-256 hash of
+  // If specified, Envoy will verify (pin) the hex-encoded SHA-256 fingerprint of
  // the presented certificate.
+  //
+  // For example, ``openssl`` can produce a SHA-256 fingerprint of an x509 certificate
+  // with the following command:
+  //
+  // .. code-block:: bash
+  //
+  //   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256
  repeated string verify_certificate_hash = 2;

  // If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of