Is it possible to disable TLS? or is it always mandatory?

[curiosport]

I know that using http instead of https is absurd I just want to know if it is possible to omit the TLS certificate during development.

[mileszhang2016]

Please refer to Chapter 19 to Chapter 21 of the following book.
https://github.com/baidu/bfe-book

[curiosport]

at first I did that but bfe refused to run and said it could not find the certificates, even though I never mentioned that feature, so I thought there must be a specific instruction to deactivate it.

[curiosport]

Those chapters do not tell me at any time if TLS is optional, I did all the steps in chapter 20 but bfe still requires TLS, so there is no way to disable it, right? I use Windows and I repeat I followed the instructions as they are in the book.

[2022/01/09 13:47:40 -05] [INFO] [3916] (main.main:93) bfe[version:1.4.0] start
[2022/01/09 13:47:40 -05] [WARN] [3916] (github.com/bfenetworks/bfe/bfe_config/bfe_conf.cipherSuitesCheck:165) CipherSuites not set, use default value [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_RC4_128_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA]
[2022/01/09 13:47:40 -05] [WARN] [3916] (github.com/bfenetworks/bfe/bfe_config/bfe_conf.curvePreferencesCheck:185) CurvePreferences not set, use default value [CurveP256]
[2022/01/09 13:47:40 -05] [EROR] [3916] (github.com/bfenetworks/bfe/bfe_server.StartUp:45) StartUp(): InitHttps():in ServerCertConfLoad() :open conf/tls_conf/server_cert_conf.data: The system cannot find the path specified.
[2022/01/09 13:47:40 -05] [EROR] [3916] (main.main:116) main(): bfe_server.StartUp(): in ServerCertConfLoad() :open conf/tls_conf/server_cert_conf.data: The system cannot find the path specified.

[daimg]

Https is not optional in bfe's configuration, related configure is also required for bfe running.
But, actually, you don't really need care about these config if you don't use https. Bfe's default config (under /conf) already includes basic https configure for bfe running, you can go ahead without any change on it.
So, the answer is yes somehow, you don't need set TLS certificate if don't use https.

[curiosport]

In the end I made a https configuration between the client and bfe, and http1.1 between bfe and the backend, as in this image:
TLS architecture

But if bfe and the backend are on two different servers the connection must be https, where should I configure that?

I modified the tls_rule_conf.data file like this:

{
    "Version": "20190101000000",
    "DefaultNextProtos": ["h2", "http/1.1"],
    "Config": {
        "login_product": {
	     "VipConf": [
                "127.0.0.1"
            ],
            "SniConf": null,
            "CertName": "localhost",
            "NextProtos": [
		"h2",
		"http/1.1"
	     ],
            "Grade": "A+",
	    "ClientAuth": true,
            "ClientCAName": "root"			
        }
    }
}

And in the client_ca folder I copied the certificate root.crt
If the backend is in http1.1 mode everything works but if I enable https mode in the backend, bfe fails to connect to it.

[kwanhur]

Maybe bfe server support to disable https, so developers just need focus on L7(http) related features.

Disable http server or https server, it's common scenario. bfe could enable both http https server by default.

Https is not optional in bfe's configuration, related configure is also required for bfe running. But, actually, you don't really need care about these config if you don't use https. Bfe's default config (under /conf) already includes basic https configure for bfe running, you can go ahead without any change on it. So, the answer is yes somehow, you don't need set TLS certificate if don't use https.

[daimg]

Https to backend is not supported, so you have to use http currently.

[curiosport]

There are plans to add that feature in the future? and then what do you recommend to avoid MitM? I can think of having a totally private IPv6 that only makes connections between bfe and the backend and sending gzip files with password, although I am not sure if this is possible with bfe.

It is likely that I am exaggerating the problem any light is welcome.

[mileszhang2016]

@curiosport ，two issues are added:

1. Add support to disable https
   Add support to disable https #977

2. Add support for https to the backend
   Add support for https to the backend #978