syntax = "proto3";

package envoy.extensions.grpc_service.channel_credentials.tls.v3;

import "envoy/extensions/transport_sockets/tls/v3/tls.proto";

import "udpa/annotations/status.proto";

option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.tls.v3";
option java_outer_classname = "TlsCredentialsProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/tls/v3;tlsv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: gRPC TLS Credentials]

// [#not-implemented-hide:]
message TlsCredentials {
  // The certificate provider instance for the root cert. Must be set.
  transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance root_certificate_provider =
      1;

  // The certificate provider instance for the identity cert. Optional;
  // if unset, no identity certificate will be sent to the server.
  transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance
      identity_certificate_provider = 2;
}
