// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v6.33.2
// source: envoy/extensions/transport_sockets/tls/v3/common.proto

package tlsv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	_ "github.com/envoyproxy/go-control-plane/envoy/annotations"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	v31 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	anypb "google.golang.org/protobuf/types/known/anypb"
	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

type TlsParameters_TlsProtocol int32

const (
	// Envoy will choose the optimal TLS version.
	TlsParameters_TLS_AUTO TlsParameters_TlsProtocol = 0
	// TLS 1.0
	TlsParameters_TLSv1_0 TlsParameters_TlsProtocol = 1
	// TLS 1.1
	TlsParameters_TLSv1_1 TlsParameters_TlsProtocol = 2
	// TLS 1.2
	TlsParameters_TLSv1_2 TlsParameters_TlsProtocol = 3
	// TLS 1.3
	TlsParameters_TLSv1_3 TlsParameters_TlsProtocol = 4
)

// Enum value maps for TlsParameters_TlsProtocol.
var (
	TlsParameters_TlsProtocol_name = map[int32]string{
		0: "TLS_AUTO",
		1: "TLSv1_0",
		2: "TLSv1_1",
		3: "TLSv1_2",
		4: "TLSv1_3",
	}
	TlsParameters_TlsProtocol_value = map[string]int32{
		"TLS_AUTO": 0,
		"TLSv1_0":  1,
		"TLSv1_1":  2,
		"TLSv1_2":  3,
		"TLSv1_3":  4,
	}
)

func (x TlsParameters_TlsProtocol) Enum() *TlsParameters_TlsProtocol {
	p := new(TlsParameters_TlsProtocol)
	*p = x
	return p
}

func (x TlsParameters_TlsProtocol) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (TlsParameters_TlsProtocol) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[0].Descriptor()
}

func (TlsParameters_TlsProtocol) Type() protoreflect.EnumType {
	return &file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[0]
}

func (x TlsParameters_TlsProtocol) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use TlsParameters_TlsProtocol.Descriptor instead.
func (TlsParameters_TlsProtocol) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{0, 0}
}

type TlsParameters_CompliancePolicy int32

const (
	// FIPS_202205 configures a TLS connection to use:
	//
	//   - TLS 1.2 or 1.3
	//   - For TLS 1.2, only ECDHE_[RSA|ECDSA]_WITH_AES_*_GCM_SHA*.
	//   - For TLS 1.3, only AES-GCM
	//   - P-256 or P-384 for key agreement.
	//   - For server signatures, only “PKCS#1/PSS“ with “SHA256/384/512“, or ECDSA
	//     with P-256 or P-384.
	//
	// .. attention::
	//
	//	Please refer to `BoringSSL policies <https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20240913.0/include/openssl/ssl.h#5608>`_
	//	for details.
	TlsParameters_FIPS_202205 TlsParameters_CompliancePolicy = 0
)

// Enum value maps for TlsParameters_CompliancePolicy.
var (
	TlsParameters_CompliancePolicy_name = map[int32]string{
		0: "FIPS_202205",
	}
	TlsParameters_CompliancePolicy_value = map[string]int32{
		"FIPS_202205": 0,
	}
)

func (x TlsParameters_CompliancePolicy) Enum() *TlsParameters_CompliancePolicy {
	p := new(TlsParameters_CompliancePolicy)
	*p = x
	return p
}

func (x TlsParameters_CompliancePolicy) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (TlsParameters_CompliancePolicy) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[1].Descriptor()
}

func (TlsParameters_CompliancePolicy) Type() protoreflect.EnumType {
	return &file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[1]
}

func (x TlsParameters_CompliancePolicy) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use TlsParameters_CompliancePolicy.Descriptor instead.
func (TlsParameters_CompliancePolicy) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{0, 1}
}

// Indicates the choice of GeneralName as defined in section 4.2.1.5 of RFC 5280 to match
// against.
type SubjectAltNameMatcher_SanType int32

const (
	SubjectAltNameMatcher_SAN_TYPE_UNSPECIFIED SubjectAltNameMatcher_SanType = 0
	SubjectAltNameMatcher_EMAIL                SubjectAltNameMatcher_SanType = 1
	SubjectAltNameMatcher_DNS                  SubjectAltNameMatcher_SanType = 2
	SubjectAltNameMatcher_URI                  SubjectAltNameMatcher_SanType = 3
	SubjectAltNameMatcher_IP_ADDRESS           SubjectAltNameMatcher_SanType = 4
	SubjectAltNameMatcher_OTHER_NAME           SubjectAltNameMatcher_SanType = 5
)

// Enum value maps for SubjectAltNameMatcher_SanType.
var (
	SubjectAltNameMatcher_SanType_name = map[int32]string{
		0: "SAN_TYPE_UNSPECIFIED",
		1: "EMAIL",
		2: "DNS",
		3: "URI",
		4: "IP_ADDRESS",
		5: "OTHER_NAME",
	}
	SubjectAltNameMatcher_SanType_value = map[string]int32{
		"SAN_TYPE_UNSPECIFIED": 0,
		"EMAIL":                1,
		"DNS":                  2,
		"URI":                  3,
		"IP_ADDRESS":           4,
		"OTHER_NAME":           5,
	}
)

func (x SubjectAltNameMatcher_SanType) Enum() *SubjectAltNameMatcher_SanType {
	p := new(SubjectAltNameMatcher_SanType)
	*p = x
	return p
}

func (x SubjectAltNameMatcher_SanType) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (SubjectAltNameMatcher_SanType) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[2].Descriptor()
}

func (SubjectAltNameMatcher_SanType) Type() protoreflect.EnumType {
	return &file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[2]
}

func (x SubjectAltNameMatcher_SanType) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use SubjectAltNameMatcher_SanType.Descriptor instead.
func (SubjectAltNameMatcher_SanType) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{5, 0}
}

// Peer certificate verification mode.
type CertificateValidationContext_TrustChainVerification int32

const (
	// Perform default certificate verification (e.g., against CA / verification lists)
	CertificateValidationContext_VERIFY_TRUST_CHAIN CertificateValidationContext_TrustChainVerification = 0
	// Connections where the certificate fails verification will be permitted.
	// For HTTP connections, the result of certificate verification can be used in route matching. (
	// see :ref:`validated <envoy_v3_api_field_config.route.v3.RouteMatch.TlsContextMatchOptions.validated>` ).
	CertificateValidationContext_ACCEPT_UNTRUSTED CertificateValidationContext_TrustChainVerification = 1
)

// Enum value maps for CertificateValidationContext_TrustChainVerification.
var (
	CertificateValidationContext_TrustChainVerification_name = map[int32]string{
		0: "VERIFY_TRUST_CHAIN",
		1: "ACCEPT_UNTRUSTED",
	}
	CertificateValidationContext_TrustChainVerification_value = map[string]int32{
		"VERIFY_TRUST_CHAIN": 0,
		"ACCEPT_UNTRUSTED":   1,
	}
)

func (x CertificateValidationContext_TrustChainVerification) Enum() *CertificateValidationContext_TrustChainVerification {
	p := new(CertificateValidationContext_TrustChainVerification)
	*p = x
	return p
}

func (x CertificateValidationContext_TrustChainVerification) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (CertificateValidationContext_TrustChainVerification) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[3].Descriptor()
}

func (CertificateValidationContext_TrustChainVerification) Type() protoreflect.EnumType {
	return &file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes[3]
}

func (x CertificateValidationContext_TrustChainVerification) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use CertificateValidationContext_TrustChainVerification.Descriptor instead.
func (CertificateValidationContext_TrustChainVerification) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{6, 0}
}

// [#next-free-field: 7]
type TlsParameters struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Minimum TLS protocol version. By default, it's “TLSv1_2“ for both clients and servers.
	//
	// TLS protocol versions below TLSv1_2 require setting compatible ciphers with the
	// “cipher_suites“ setting as the default ciphers no longer include compatible ciphers.
	//
	// .. attention::
	//
	//	Using TLS protocol versions below TLSv1_2 has serious security considerations and risks.
	TlsMinimumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,1,opt,name=tls_minimum_protocol_version,json=tlsMinimumProtocolVersion,proto3,enum=envoy.extensions.transport_sockets.tls.v3.TlsParameters_TlsProtocol" json:"tls_minimum_protocol_version,omitempty"`
	// Maximum TLS protocol version. By default, it's “TLSv1_2“ for clients and “TLSv1_3“ for
	// servers.
	TlsMaximumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,2,opt,name=tls_maximum_protocol_version,json=tlsMaximumProtocolVersion,proto3,enum=envoy.extensions.transport_sockets.tls.v3.TlsParameters_TlsProtocol" json:"tls_maximum_protocol_version,omitempty"`
	// If specified, the TLS listener will only support the specified `cipher list
	// <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
	// when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3).
	//
	// If not specified, a default list will be used. Defaults are different for server (downstream) and
	// client (upstream) TLS configurations.
	// Defaults will change over time in response to security considerations; If you care, configure
	// it instead of using the default.
	//
	// In non-FIPS builds, the default server cipher list is:
	//
	// .. code-block:: none
	//
	//	[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
	//	[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default server cipher list is:
	//
	// .. code-block:: none
	//
	//	ECDHE-ECDSA-AES128-GCM-SHA256
	//	ECDHE-RSA-AES128-GCM-SHA256
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	//
	// In non-FIPS builds, the default client cipher list is:
	//
	// .. code-block:: none
	//
	//	[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
	//	[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default client cipher list is:
	//
	// .. code-block:: none
	//
	//	ECDHE-ECDSA-AES128-GCM-SHA256
	//	ECDHE-RSA-AES128-GCM-SHA256
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	CipherSuites []string `protobuf:"bytes,3,rep,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
	// If specified, the TLS connection will only support the specified ECDH
	// curves. If not specified, the default curves will be used.
	//
	// In non-FIPS builds, the default curves are:
	//
	// .. code-block:: none
	//
	//	X25519
	//	P-256
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
	//
	// .. code-block:: none
	//
	//	P-256
	EcdhCurves []string `protobuf:"bytes,4,rep,name=ecdh_curves,json=ecdhCurves,proto3" json:"ecdh_curves,omitempty"`
	// If specified, the TLS connection will only support the specified signature algorithms.
	// The list is ordered by preference.
	// If not specified, the default signature algorithms defined by BoringSSL will be used.
	//
	// Default signature algorithms selected by BoringSSL (may be out of date):
	//
	// .. code-block:: none
	//
	//	ecdsa_secp256r1_sha256
	//	rsa_pss_rsae_sha256
	//	rsa_pkcs1_sha256
	//	ecdsa_secp384r1_sha384
	//	rsa_pss_rsae_sha384
	//	rsa_pkcs1_sha384
	//	rsa_pss_rsae_sha512
	//	rsa_pkcs1_sha512
	//	rsa_pkcs1_sha1
	//
	// Signature algorithms supported by BoringSSL (may be out of date):
	//
	// .. code-block:: none
	//
	//	rsa_pkcs1_sha256
	//	rsa_pkcs1_sha384
	//	rsa_pkcs1_sha512
	//	ecdsa_secp256r1_sha256
	//	ecdsa_secp384r1_sha384
	//	ecdsa_secp521r1_sha512
	//	rsa_pss_rsae_sha256
	//	rsa_pss_rsae_sha384
	//	rsa_pss_rsae_sha512
	//	ed25519
	//	rsa_pkcs1_sha1
	//	ecdsa_sha1
	SignatureAlgorithms []string `protobuf:"bytes,5,rep,name=signature_algorithms,json=signatureAlgorithms,proto3" json:"signature_algorithms,omitempty"`
	// Compliance policies configure various aspects of the TLS based on the given policy.
	// The policies are applied last during configuration and may override the other TLS
	// parameters, or any previous policy.
	CompliancePolicies []TlsParameters_CompliancePolicy `protobuf:"varint,6,rep,packed,name=compliance_policies,json=compliancePolicies,proto3,enum=envoy.extensions.transport_sockets.tls.v3.TlsParameters_CompliancePolicy" json:"compliance_policies,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *TlsParameters) Reset() {
	*x = TlsParameters{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsParameters) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsParameters) ProtoMessage() {}

func (x *TlsParameters) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsParameters.ProtoReflect.Descriptor instead.
func (*TlsParameters) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{0}
}

func (x *TlsParameters) GetTlsMinimumProtocolVersion() TlsParameters_TlsProtocol {
	if x != nil {
		return x.TlsMinimumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (x *TlsParameters) GetTlsMaximumProtocolVersion() TlsParameters_TlsProtocol {
	if x != nil {
		return x.TlsMaximumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (x *TlsParameters) GetCipherSuites() []string {
	if x != nil {
		return x.CipherSuites
	}
	return nil
}

func (x *TlsParameters) GetEcdhCurves() []string {
	if x != nil {
		return x.EcdhCurves
	}
	return nil
}

func (x *TlsParameters) GetSignatureAlgorithms() []string {
	if x != nil {
		return x.SignatureAlgorithms
	}
	return nil
}

func (x *TlsParameters) GetCompliancePolicies() []TlsParameters_CompliancePolicy {
	if x != nil {
		return x.CompliancePolicies
	}
	return nil
}

// BoringSSL private key method configuration. The private key methods are used for external
// (potentially asynchronous) signing and decryption operations. Some use cases for private key
// methods would be TPM support and TLS acceleration.
type PrivateKeyProvider struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Private key method provider name. The name must match a
	// supported private key method provider type.
	ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Private key method provider specific configuration.
	//
	// Types that are valid to be assigned to ConfigType:
	//
	//	*PrivateKeyProvider_TypedConfig
	ConfigType isPrivateKeyProvider_ConfigType `protobuf_oneof:"config_type"`
	// If the private key provider isn't available (eg. the required hardware capability doesn't existed),
	// Envoy will fallback to the BoringSSL default implementation when the “fallback“ is true.
	// The default value is “false“.
	Fallback      bool `protobuf:"varint,4,opt,name=fallback,proto3" json:"fallback,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PrivateKeyProvider) Reset() {
	*x = PrivateKeyProvider{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PrivateKeyProvider) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PrivateKeyProvider) ProtoMessage() {}

func (x *PrivateKeyProvider) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PrivateKeyProvider.ProtoReflect.Descriptor instead.
func (*PrivateKeyProvider) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{1}
}

func (x *PrivateKeyProvider) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *PrivateKeyProvider) GetConfigType() isPrivateKeyProvider_ConfigType {
	if x != nil {
		return x.ConfigType
	}
	return nil
}

func (x *PrivateKeyProvider) GetTypedConfig() *anypb.Any {
	if x != nil {
		if x, ok := x.ConfigType.(*PrivateKeyProvider_TypedConfig); ok {
			return x.TypedConfig
		}
	}
	return nil
}

func (x *PrivateKeyProvider) GetFallback() bool {
	if x != nil {
		return x.Fallback
	}
	return false
}

type isPrivateKeyProvider_ConfigType interface {
	isPrivateKeyProvider_ConfigType()
}

type PrivateKeyProvider_TypedConfig struct {
	TypedConfig *anypb.Any `protobuf:"bytes,3,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

func (*PrivateKeyProvider_TypedConfig) isPrivateKeyProvider_ConfigType() {}

// [#next-free-field: 9]
type TlsCertificate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The TLS certificate chain.
	//
	// If “certificate_chain“ is a filesystem path, a watch will be added to the
	// parent directory for any file moves to support rotation. This currently
	// only applies to dynamic secrets, when the “TlsCertificate“ is delivered via
	// SDS.
	CertificateChain *v3.DataSource `protobuf:"bytes,1,opt,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The TLS private key.
	//
	// If “private_key“ is a filesystem path, a watch will be added to the parent
	// directory for any file moves to support rotation. This currently only
	// applies to dynamic secrets, when the “TlsCertificate“ is delivered via SDS.
	PrivateKey *v3.DataSource `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// “Pkcs12“ data containing TLS certificate, chain, and private key.
	//
	// If “pkcs12“ is a filesystem path, the file will be read, but no watch will
	// be added to the parent directory, since “pkcs12“ isn't used by SDS.
	// This field is mutually exclusive with “certificate_chain“, “private_key“ and “private_key_provider“.
	// This can't be marked as “oneof“ due to API compatibility reasons. Setting
	// both :ref:`private_key <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>`,
	// :ref:`certificate_chain <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.certificate_chain>`,
	// or :ref:`private_key_provider <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key_provider>`
	// and :ref:`pkcs12 <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.pkcs12>`
	// fields will result in an error. Use :ref:`password
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.password>`
	// to specify the password to unprotect the “PKCS12“ data, if necessary.
	Pkcs12 *v3.DataSource `protobuf:"bytes,8,opt,name=pkcs12,proto3" json:"pkcs12,omitempty"`
	// If specified, updates of file-based “certificate_chain“ and “private_key“
	// sources will be triggered by this watch. The certificate/key pair will be
	// read together and validated for atomic read consistency (i.e. no
	// intervening modification occurred between cert/key read, verified by file
	// hash comparisons). This allows explicit control over the path watched, by
	// default the parent directories of the filesystem paths in
	// “certificate_chain“ and “private_key“ are watched if this field is not
	// specified. This only applies when a “TlsCertificate“ is delivered by SDS
	// with references to filesystem paths. See the :ref:`SDS key rotation
	// <sds_key_rotation>` documentation for further details.
	WatchedDirectory *v3.WatchedDirectory `protobuf:"bytes,7,opt,name=watched_directory,json=watchedDirectory,proto3" json:"watched_directory,omitempty"`
	// BoringSSL private key method provider. This is an alternative to :ref:`private_key
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>` field.
	// When both :ref:`private_key <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>` and
	// :ref:`private_key_provider <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key_provider>` fields are set,
	// “private_key_provider“ takes precedence.
	// If “private_key_provider“ is unavailable and :ref:`fallback
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.PrivateKeyProvider.fallback>`
	// is enabled, “private_key“ will be used.
	PrivateKeyProvider *PrivateKeyProvider `protobuf:"bytes,6,opt,name=private_key_provider,json=privateKeyProvider,proto3" json:"private_key_provider,omitempty"`
	// The password to decrypt the TLS private key. If this field is not set, it is assumed that the
	// TLS private key is not password encrypted.
	Password *v3.DataSource `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
	// The OCSP response to be stapled with this certificate during the handshake.
	// The response must be DER-encoded and may only be  provided via “filename“ or
	// “inline_bytes“. The response may pertain to only one certificate.
	OcspStaple *v3.DataSource `protobuf:"bytes,4,opt,name=ocsp_staple,json=ocspStaple,proto3" json:"ocsp_staple,omitempty"`
	// [#not-implemented-hide:]
	SignedCertificateTimestamp []*v3.DataSource `protobuf:"bytes,5,rep,name=signed_certificate_timestamp,json=signedCertificateTimestamp,proto3" json:"signed_certificate_timestamp,omitempty"`
	unknownFields              protoimpl.UnknownFields
	sizeCache                  protoimpl.SizeCache
}

func (x *TlsCertificate) Reset() {
	*x = TlsCertificate{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsCertificate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsCertificate) ProtoMessage() {}

func (x *TlsCertificate) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsCertificate.ProtoReflect.Descriptor instead.
func (*TlsCertificate) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{2}
}

func (x *TlsCertificate) GetCertificateChain() *v3.DataSource {
	if x != nil {
		return x.CertificateChain
	}
	return nil
}

func (x *TlsCertificate) GetPrivateKey() *v3.DataSource {
	if x != nil {
		return x.PrivateKey
	}
	return nil
}

func (x *TlsCertificate) GetPkcs12() *v3.DataSource {
	if x != nil {
		return x.Pkcs12
	}
	return nil
}

func (x *TlsCertificate) GetWatchedDirectory() *v3.WatchedDirectory {
	if x != nil {
		return x.WatchedDirectory
	}
	return nil
}

func (x *TlsCertificate) GetPrivateKeyProvider() *PrivateKeyProvider {
	if x != nil {
		return x.PrivateKeyProvider
	}
	return nil
}

func (x *TlsCertificate) GetPassword() *v3.DataSource {
	if x != nil {
		return x.Password
	}
	return nil
}

func (x *TlsCertificate) GetOcspStaple() *v3.DataSource {
	if x != nil {
		return x.OcspStaple
	}
	return nil
}

func (x *TlsCertificate) GetSignedCertificateTimestamp() []*v3.DataSource {
	if x != nil {
		return x.SignedCertificateTimestamp
	}
	return nil
}

type TlsSessionTicketKeys struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Keys for encrypting and decrypting TLS session tickets. The
	// first key in the array contains the key to encrypt all new sessions created by this context.
	// All keys are candidates for decrypting received tickets. This allows for easy rotation of keys
	// by, for example, putting the new key first, and the previous key second.
	//
	// If :ref:`session_ticket_keys <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys>`
	// is not specified, the TLS library will still support resuming sessions via tickets, but it will
	// use an internally-generated and managed key, so sessions cannot be resumed across hot restarts
	// or on different hosts.
	//
	// Each key must contain exactly 80 bytes of cryptographically-secure random data. For
	// example, the output of “openssl rand 80“.
	//
	// .. attention::
	//
	//	Using this feature has serious security considerations and risks. Improper handling of keys
	//	may result in loss of secrecy in connections, even if ciphers supporting perfect forward
	//	secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some
	//	discussion. To minimize the risk, you must:
	//
	//	* Keep the session ticket keys at least as secure as your TLS certificate private keys
	//	* Rotate session ticket keys at least daily, and preferably hourly
	//	* Always generate keys using a cryptographically-secure random data source
	Keys          []*v3.DataSource `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TlsSessionTicketKeys) Reset() {
	*x = TlsSessionTicketKeys{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsSessionTicketKeys) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsSessionTicketKeys) ProtoMessage() {}

func (x *TlsSessionTicketKeys) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsSessionTicketKeys.ProtoReflect.Descriptor instead.
func (*TlsSessionTicketKeys) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{3}
}

func (x *TlsSessionTicketKeys) GetKeys() []*v3.DataSource {
	if x != nil {
		return x.Keys
	}
	return nil
}

// Indicates a certificate to be obtained from a named CertificateProvider plugin instance.
// The plugin instances are defined in the client's bootstrap file.
// The plugin allows certificates to be fetched/refreshed over the network asynchronously with
// respect to the TLS handshake.
// [#not-implemented-hide:]
type CertificateProviderPluginInstance struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Provider instance name.
	//
	// Instance names should generally be defined not in terms of the underlying provider
	// implementation (e.g., "file_watcher") but rather in terms of the function of the
	// certificates (e.g., "foo_deployment_identity").
	InstanceName string `protobuf:"bytes,1,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
	// Opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify
	// a root-certificate (validation context) or "example.com" to specify a certificate for a
	// particular domain. Not all provider instances will actually use this field, so the value
	// defaults to the empty string.
	CertificateName string `protobuf:"bytes,2,opt,name=certificate_name,json=certificateName,proto3" json:"certificate_name,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *CertificateProviderPluginInstance) Reset() {
	*x = CertificateProviderPluginInstance{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CertificateProviderPluginInstance) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CertificateProviderPluginInstance) ProtoMessage() {}

func (x *CertificateProviderPluginInstance) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CertificateProviderPluginInstance.ProtoReflect.Descriptor instead.
func (*CertificateProviderPluginInstance) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{4}
}

func (x *CertificateProviderPluginInstance) GetInstanceName() string {
	if x != nil {
		return x.InstanceName
	}
	return ""
}

func (x *CertificateProviderPluginInstance) GetCertificateName() string {
	if x != nil {
		return x.CertificateName
	}
	return ""
}

// Matcher for subject alternative names, to match both type and value of the SAN.
type SubjectAltNameMatcher struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Specification of type of SAN. Note that the default enum value is an invalid choice.
	SanType SubjectAltNameMatcher_SanType `protobuf:"varint,1,opt,name=san_type,json=sanType,proto3,enum=envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher_SanType" json:"san_type,omitempty"`
	// Matcher for SAN value.
	//
	// If the :ref:`san_type <envoy_v3_api_field_extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.san_type>`
	// is :ref:`DNS <envoy_v3_api_enum_value_extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.SanType.DNS>`
	// and the matcher type is :ref:`exact <envoy_v3_api_field_type.matcher.v3.StringMatcher.exact>`, DNS wildcards are evaluated
	// according to the rules in https://www.rfc-editor.org/rfc/rfc6125#section-6.4.3.
	// For example, “*.example.com“ would match “test.example.com“ but not “example.com“ and not
	// “a.b.example.com“.
	//
	// The string matching for OTHER_NAME SAN values depends on their ASN.1 type:
	//
	//   - OBJECT: Validated against its dotted numeric notation (e.g., "1.2.3.4")
	//   - BOOLEAN: Validated against strings "true" or "false"
	//   - INTEGER/ENUMERATED: Validated against a string containing the integer value
	//   - NULL: Validated against an empty string
	//   - Other types: Validated directly against the string value
	Matcher *v31.StringMatcher `protobuf:"bytes,2,opt,name=matcher,proto3" json:"matcher,omitempty"`
	// OID Value which is required if OTHER_NAME SAN type is used.
	// For example, UPN OID is 1.3.6.1.4.1.311.20.2.3
	// (Reference: http://oid-info.com/get/1.3.6.1.4.1.311.20.2.3).
	//
	// If set for SAN types other than OTHER_NAME, it will be ignored.
	Oid           string `protobuf:"bytes,3,opt,name=oid,proto3" json:"oid,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SubjectAltNameMatcher) Reset() {
	*x = SubjectAltNameMatcher{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SubjectAltNameMatcher) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SubjectAltNameMatcher) ProtoMessage() {}

func (x *SubjectAltNameMatcher) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SubjectAltNameMatcher.ProtoReflect.Descriptor instead.
func (*SubjectAltNameMatcher) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{5}
}

func (x *SubjectAltNameMatcher) GetSanType() SubjectAltNameMatcher_SanType {
	if x != nil {
		return x.SanType
	}
	return SubjectAltNameMatcher_SAN_TYPE_UNSPECIFIED
}

func (x *SubjectAltNameMatcher) GetMatcher() *v31.StringMatcher {
	if x != nil {
		return x.Matcher
	}
	return nil
}

func (x *SubjectAltNameMatcher) GetOid() string {
	if x != nil {
		return x.Oid
	}
	return ""
}

// [#next-free-field: 18]
type CertificateValidationContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// TLS certificate data containing certificate authority certificates to use in verifying
	// a presented peer certificate (e.g. server certificate for clusters or client certificate
	// for listeners). If not specified and a peer certificate is presented it will not be
	// verified. By default, a client certificate is optional, unless one of the additional
	// options (:ref:`require_client_certificate
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.require_client_certificate>`,
	// :ref:`verify_certificate_spki
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>`,
	// :ref:`verify_certificate_hash
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>`, or
	// :ref:`match_typed_subject_alt_names
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`) is also
	// specified.
	//
	// It can optionally contain certificate revocation lists, in which case Envoy will verify
	// that the presented peer certificate has not been revoked by one of the included CRLs. Note
	// that if a CRL is provided for any certificate authority in a trust chain, a CRL must be
	// provided for all certificate authorities in that chain. Failure to do so will result in
	// verification failure for both revoked and unrevoked certificates from that chain.
	// The behavior of requiring all certificates to contain CRLs can be altered by
	// setting :ref:`only_verify_leaf_cert_crl <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.only_verify_leaf_cert_crl>`
	// true. If set to true, only the final certificate in the chain undergoes CRL verification.
	//
	// See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
	// system CA locations.
	//
	// If “trusted_ca“ is a filesystem path, a watch will be added to the parent
	// directory for any file moves to support rotation. This currently only
	// applies to dynamic secrets, when the “CertificateValidationContext“ is
	// delivered via SDS.
	//
	// X509_V_FLAG_PARTIAL_CHAIN is set by default, so non-root/intermediate ca certificate in “trusted_ca“
	// can be treated as trust anchor as well. It allows verification with building valid partial chain instead
	// of a full chain.
	//
	// If “ca_certificate_provider_instance“ is set, it takes precedence over “trusted_ca“.
	TrustedCa *v3.DataSource `protobuf:"bytes,1,opt,name=trusted_ca,json=trustedCa,proto3" json:"trusted_ca,omitempty"`
	// Certificate provider instance for fetching TLS certificates.
	//
	// If set, takes precedence over “trusted_ca“.
	// [#not-implemented-hide:]
	CaCertificateProviderInstance *CertificateProviderPluginInstance `protobuf:"bytes,13,opt,name=ca_certificate_provider_instance,json=caCertificateProviderInstance,proto3" json:"ca_certificate_provider_instance,omitempty"`
	// Use system root certs for validation.
	// If present, system root certs are used only if neither of the “trusted_ca“
	// or “ca_certificate_provider_instance“ fields are set.
	// [#not-implemented-hide:]
	SystemRootCerts *CertificateValidationContext_SystemRootCerts `protobuf:"bytes,17,opt,name=system_root_certs,json=systemRootCerts,proto3" json:"system_root_certs,omitempty"`
	// If specified, updates of a file-based “trusted_ca“ source will be triggered
	// by this watch. This allows explicit control over the path watched, by
	// default the parent directory of the filesystem path in “trusted_ca“ is
	// watched if this field is not specified. This only applies when a
	// “CertificateValidationContext“ is delivered by SDS with references to
	// filesystem paths. See the :ref:`SDS key rotation <sds_key_rotation>`
	// documentation for further details.
	WatchedDirectory *v3.WatchedDirectory `protobuf:"bytes,11,opt,name=watched_directory,json=watchedDirectory,proto3" json:"watched_directory,omitempty"`
	// An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
	// SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
	// matches one of the specified values.
	//
	// A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -noout -pubkey
	//	  | openssl pkey -pubin -outform DER
	//	  | openssl dgst -sha256 -binary
	//	  | openssl enc -base64
	//	NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
	//
	// This is the format used in HTTP Public Key Pinning.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	//
	// .. attention::
	//
	//	This option is preferred over :ref:`verify_certificate_hash
	//	<envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>`,
	//	because SPKI is tied to a private key, so it doesn't change when the certificate
	//	is renewed using the same private key.
	VerifyCertificateSpki []string `protobuf:"bytes,3,rep,name=verify_certificate_spki,json=verifyCertificateSpki,proto3" json:"verify_certificate_spki,omitempty"`
	// An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
	// the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
	//
	// A hex-encoded SHA-256 of the certificate can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
	//	df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
	//
	// A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
	//	DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
	//
	// Both of those formats are acceptable.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	VerifyCertificateHash []string `protobuf:"bytes,2,rep,name=verify_certificate_hash,json=verifyCertificateHash,proto3" json:"verify_certificate_hash,omitempty"`
	// An optional list of Subject Alternative name matchers. If specified, Envoy will verify that the
	// Subject Alternative Name of the presented certificate matches one of the specified matchers.
	// The matching uses "any" semantics, that is to say, the SAN is verified if at least one matcher is
	// matched.
	//
	// When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
	// configured with exact match type in the :ref:`string matcher <envoy_v3_api_msg_type.matcher.v3.StringMatcher>`.
	// For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
	// it should be configured as shown below.
	//
	// .. code-block:: yaml
	//
	//	match_typed_subject_alt_names:
	//	- san_type: DNS
	//	  matcher:
	//	    exact: "api.example.com"
	//
	// .. attention::
	//
	//	Subject Alternative Names are easily spoofable and verifying only them is insecure,
	//	therefore this option must be used together with :ref:`trusted_ca
	//	<envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca>`.
	MatchTypedSubjectAltNames []*SubjectAltNameMatcher `protobuf:"bytes,15,rep,name=match_typed_subject_alt_names,json=matchTypedSubjectAltNames,proto3" json:"match_typed_subject_alt_names,omitempty"`
	// This field is deprecated in favor of
	// :ref:`match_typed_subject_alt_names
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`.
	// Note that if both this field and :ref:`match_typed_subject_alt_names
	// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`
	// are specified, the former (deprecated field) is ignored.
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/common.proto.
	MatchSubjectAltNames []*v31.StringMatcher `protobuf:"bytes,9,rep,name=match_subject_alt_names,json=matchSubjectAltNames,proto3" json:"match_subject_alt_names,omitempty"`
	// [#not-implemented-hide:] Must present signed certificate time-stamp.
	RequireSignedCertificateTimestamp *wrapperspb.BoolValue `protobuf:"bytes,6,opt,name=require_signed_certificate_timestamp,json=requireSignedCertificateTimestamp,proto3" json:"require_signed_certificate_timestamp,omitempty"`
	// An optional `certificate revocation list
	// <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
	// (in PEM format). If specified, Envoy will verify that the presented peer
	// certificate has not been revoked by this CRL. If this DataSource contains
	// multiple CRLs, all of them will be used. Note that if a CRL is provided
	// for any certificate authority in a trust chain, a CRL must be provided
	// for all certificate authorities in that chain. Failure to do so will
	// result in verification failure for both revoked and unrevoked certificates
	// from that chain. This default behavior can be altered by setting
	// :ref:`only_verify_leaf_cert_crl <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.only_verify_leaf_cert_crl>` to
	// true.
	//
	// If “crl“ is a filesystem path, a watch will be added to the parent
	// directory for any file moves to support rotation. This currently only
	// applies to dynamic secrets, when the “CertificateValidationContext“ is
	// delivered via SDS.
	Crl *v3.DataSource `protobuf:"bytes,7,opt,name=crl,proto3" json:"crl,omitempty"`
	// If specified, Envoy will not reject expired certificates.
	AllowExpiredCertificate bool `protobuf:"varint,8,opt,name=allow_expired_certificate,json=allowExpiredCertificate,proto3" json:"allow_expired_certificate,omitempty"`
	// Certificate trust chain verification mode.
	TrustChainVerification CertificateValidationContext_TrustChainVerification `protobuf:"varint,10,opt,name=trust_chain_verification,json=trustChainVerification,proto3,enum=envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext_TrustChainVerification" json:"trust_chain_verification,omitempty"`
	// The configuration of an extension specific certificate validator.
	// If specified, all validation is done by the specified validator,
	// and the behavior of all other validation settings is defined by the specified validator (and may be entirely ignored, unused, and unvalidated).
	// Refer to the documentation for the specified validator. If you do not want a custom validation algorithm, do not set this field.
	// [#extension-category: envoy.tls.cert_validator]
	CustomValidatorConfig *v3.TypedExtensionConfig `protobuf:"bytes,12,opt,name=custom_validator_config,json=customValidatorConfig,proto3" json:"custom_validator_config,omitempty"`
	// If this option is set to true, only the certificate at the end of the
	// certificate chain will be subject to validation by :ref:`CRL <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.crl>`.
	OnlyVerifyLeafCertCrl bool `protobuf:"varint,14,opt,name=only_verify_leaf_cert_crl,json=onlyVerifyLeafCertCrl,proto3" json:"only_verify_leaf_cert_crl,omitempty"`
	// Defines maximum depth of a certificate chain accepted in verification, the default limit is 100, though this can be system-dependent.
	// This number does not include the leaf but includes the trust anchor, so a depth of 1 allows the leaf and one CA certificate. If a trusted issuer
	// appears in the chain, but in a depth larger than configured, the certificate validation will fail.
	// This matches the semantics of “SSL_CTX_set_verify_depth“ in OpenSSL 1.0.x and older versions of BoringSSL. It differs from “SSL_CTX_set_verify_depth“
	// in OpenSSL 1.1.x and newer versions of BoringSSL in that the trust anchor is included.
	// Trusted issues are specified by setting :ref:`trusted_ca <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca>`
	MaxVerifyDepth *wrapperspb.UInt32Value `protobuf:"bytes,16,opt,name=max_verify_depth,json=maxVerifyDepth,proto3" json:"max_verify_depth,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *CertificateValidationContext) Reset() {
	*x = CertificateValidationContext{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CertificateValidationContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CertificateValidationContext) ProtoMessage() {}

func (x *CertificateValidationContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CertificateValidationContext.ProtoReflect.Descriptor instead.
func (*CertificateValidationContext) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{6}
}

func (x *CertificateValidationContext) GetTrustedCa() *v3.DataSource {
	if x != nil {
		return x.TrustedCa
	}
	return nil
}

func (x *CertificateValidationContext) GetCaCertificateProviderInstance() *CertificateProviderPluginInstance {
	if x != nil {
		return x.CaCertificateProviderInstance
	}
	return nil
}

func (x *CertificateValidationContext) GetSystemRootCerts() *CertificateValidationContext_SystemRootCerts {
	if x != nil {
		return x.SystemRootCerts
	}
	return nil
}

func (x *CertificateValidationContext) GetWatchedDirectory() *v3.WatchedDirectory {
	if x != nil {
		return x.WatchedDirectory
	}
	return nil
}

func (x *CertificateValidationContext) GetVerifyCertificateSpki() []string {
	if x != nil {
		return x.VerifyCertificateSpki
	}
	return nil
}

func (x *CertificateValidationContext) GetVerifyCertificateHash() []string {
	if x != nil {
		return x.VerifyCertificateHash
	}
	return nil
}

func (x *CertificateValidationContext) GetMatchTypedSubjectAltNames() []*SubjectAltNameMatcher {
	if x != nil {
		return x.MatchTypedSubjectAltNames
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/common.proto.
func (x *CertificateValidationContext) GetMatchSubjectAltNames() []*v31.StringMatcher {
	if x != nil {
		return x.MatchSubjectAltNames
	}
	return nil
}

func (x *CertificateValidationContext) GetRequireSignedCertificateTimestamp() *wrapperspb.BoolValue {
	if x != nil {
		return x.RequireSignedCertificateTimestamp
	}
	return nil
}

func (x *CertificateValidationContext) GetCrl() *v3.DataSource {
	if x != nil {
		return x.Crl
	}
	return nil
}

func (x *CertificateValidationContext) GetAllowExpiredCertificate() bool {
	if x != nil {
		return x.AllowExpiredCertificate
	}
	return false
}

func (x *CertificateValidationContext) GetTrustChainVerification() CertificateValidationContext_TrustChainVerification {
	if x != nil {
		return x.TrustChainVerification
	}
	return CertificateValidationContext_VERIFY_TRUST_CHAIN
}

func (x *CertificateValidationContext) GetCustomValidatorConfig() *v3.TypedExtensionConfig {
	if x != nil {
		return x.CustomValidatorConfig
	}
	return nil
}

func (x *CertificateValidationContext) GetOnlyVerifyLeafCertCrl() bool {
	if x != nil {
		return x.OnlyVerifyLeafCertCrl
	}
	return false
}

func (x *CertificateValidationContext) GetMaxVerifyDepth() *wrapperspb.UInt32Value {
	if x != nil {
		return x.MaxVerifyDepth
	}
	return nil
}

type CertificateValidationContext_SystemRootCerts struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CertificateValidationContext_SystemRootCerts) Reset() {
	*x = CertificateValidationContext_SystemRootCerts{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CertificateValidationContext_SystemRootCerts) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CertificateValidationContext_SystemRootCerts) ProtoMessage() {}

func (x *CertificateValidationContext_SystemRootCerts) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CertificateValidationContext_SystemRootCerts.ProtoReflect.Descriptor instead.
func (*CertificateValidationContext_SystemRootCerts) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP(), []int{6, 0}
}

var File_envoy_extensions_transport_sockets_tls_v3_common_proto protoreflect.FileDescriptor

const file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDesc = "" +
	"\n" +
	"6envoy/extensions/transport_sockets/tls/v3/common.proto\x12)envoy.extensions.transport_sockets.tls.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a$envoy/config/core/v3/extension.proto\x1a\"envoy/type/matcher/v3/string.proto\x1a\x19google/protobuf/any.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a#envoy/annotations/deprecation.proto\x1a\x1eudpa/annotations/migrate.proto\x1a udpa/annotations/sensitive.proto\x1a\x1dudpa/annotations/status.proto\x1a!udpa/annotations/versioning.proto\x1a\x17validate/validate.proto\"\xd1\x05\n" +
	"\rTlsParameters\x12\x8f\x01\n" +
	"\x1ctls_minimum_protocol_version\x18\x01 \x01(\x0e2D.envoy.extensions.transport_sockets.tls.v3.TlsParameters.TlsProtocolB\b\xfaB\x05\x82\x01\x02\x10\x01R\x19tlsMinimumProtocolVersion\x12\x8f\x01\n" +
	"\x1ctls_maximum_protocol_version\x18\x02 \x01(\x0e2D.envoy.extensions.transport_sockets.tls.v3.TlsParameters.TlsProtocolB\b\xfaB\x05\x82\x01\x02\x10\x01R\x19tlsMaximumProtocolVersion\x12#\n" +
	"\rcipher_suites\x18\x03 \x03(\tR\fcipherSuites\x12\x1f\n" +
	"\vecdh_curves\x18\x04 \x03(\tR\n" +
	"ecdhCurves\x121\n" +
	"\x14signature_algorithms\x18\x05 \x03(\tR\x13signatureAlgorithms\x12\x84\x01\n" +
	"\x13compliance_policies\x18\x06 \x03(\x0e2I.envoy.extensions.transport_sockets.tls.v3.TlsParameters.CompliancePolicyB\b\xfaB\x05\x92\x01\x02\x10\x01R\x12compliancePolicies\"O\n" +
	"\vTlsProtocol\x12\f\n" +
	"\bTLS_AUTO\x10\x00\x12\v\n" +
	"\aTLSv1_0\x10\x01\x12\v\n" +
	"\aTLSv1_1\x10\x02\x12\v\n" +
	"\aTLSv1_2\x10\x03\x12\v\n" +
	"\aTLSv1_3\x10\x04\"#\n" +
	"\x10CompliancePolicy\x12\x0f\n" +
	"\vFIPS_202205\x10\x00:&\x9aň\x1e!\n" +
	"\x1fenvoy.api.v2.auth.TlsParameters\"\xeb\x01\n" +
	"\x12PrivateKeyProvider\x12,\n" +
	"\rprovider_name\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\fproviderName\x12A\n" +
	"\ftyped_config\x18\x03 \x01(\v2\x14.google.protobuf.AnyB\x06\xb8\xb7\x8b\xa4\x02\x01H\x00R\vtypedConfig\x12\x1a\n" +
	"\bfallback\x18\x04 \x01(\bR\bfallback:+\x9aň\x1e&\n" +
	"$envoy.api.v2.auth.PrivateKeyProviderB\r\n" +
	"\vconfig_typeJ\x04\b\x02\x10\x03R\x06config\"\xc8\x05\n" +
	"\x0eTlsCertificate\x12M\n" +
	"\x11certificate_chain\x18\x01 \x01(\v2 .envoy.config.core.v3.DataSourceR\x10certificateChain\x12I\n" +
	"\vprivate_key\x18\x02 \x01(\v2 .envoy.config.core.v3.DataSourceB\x06\xb8\xb7\x8b\xa4\x02\x01R\n" +
	"privateKey\x12@\n" +
	"\x06pkcs12\x18\b \x01(\v2 .envoy.config.core.v3.DataSourceB\x06\xb8\xb7\x8b\xa4\x02\x01R\x06pkcs12\x12S\n" +
	"\x11watched_directory\x18\a \x01(\v2&.envoy.config.core.v3.WatchedDirectoryR\x10watchedDirectory\x12o\n" +
	"\x14private_key_provider\x18\x06 \x01(\v2=.envoy.extensions.transport_sockets.tls.v3.PrivateKeyProviderR\x12privateKeyProvider\x12D\n" +
	"\bpassword\x18\x03 \x01(\v2 .envoy.config.core.v3.DataSourceB\x06\xb8\xb7\x8b\xa4\x02\x01R\bpassword\x12A\n" +
	"\vocsp_staple\x18\x04 \x01(\v2 .envoy.config.core.v3.DataSourceR\n" +
	"ocspStaple\x12b\n" +
	"\x1csigned_certificate_timestamp\x18\x05 \x03(\v2 .envoy.config.core.v3.DataSourceR\x1asignedCertificateTimestamp:'\x9aň\x1e\"\n" +
	" envoy.api.v2.auth.TlsCertificate\"\x8b\x01\n" +
	"\x14TlsSessionTicketKeys\x12D\n" +
	"\x04keys\x18\x01 \x03(\v2 .envoy.config.core.v3.DataSourceB\x0e\xfaB\x05\x92\x01\x02\b\x01\xb8\xb7\x8b\xa4\x02\x01R\x04keys:-\x9aň\x1e(\n" +
	"&envoy.api.v2.auth.TlsSessionTicketKeys\"|\n" +
	"!CertificateProviderPluginInstance\x12,\n" +
	"\rinstance_name\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\finstanceName\x12)\n" +
	"\x10certificate_name\x18\x02 \x01(\tR\x0fcertificateName\"\xc6\x02\n" +
	"\x15SubjectAltNameMatcher\x12o\n" +
	"\bsan_type\x18\x01 \x01(\x0e2H.envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.SanTypeB\n" +
	"\xfaB\a\x82\x01\x04\x10\x01 \x00R\asanType\x12H\n" +
	"\amatcher\x18\x02 \x01(\v2$.envoy.type.matcher.v3.StringMatcherB\b\xfaB\x05\x8a\x01\x02\x10\x01R\amatcher\x12\x10\n" +
	"\x03oid\x18\x03 \x01(\tR\x03oid\"`\n" +
	"\aSanType\x12\x18\n" +
	"\x14SAN_TYPE_UNSPECIFIED\x10\x00\x12\t\n" +
	"\x05EMAIL\x10\x01\x12\a\n" +
	"\x03DNS\x10\x02\x12\a\n" +
	"\x03URI\x10\x03\x12\x0e\n" +
	"\n" +
	"IP_ADDRESS\x10\x04\x12\x0e\n" +
	"\n" +
	"OTHER_NAME\x10\x05\"\xa9\r\n" +
	"\x1cCertificateValidationContext\x12W\n" +
	"\n" +
	"trusted_ca\x18\x01 \x01(\v2 .envoy.config.core.v3.DataSourceB\x16\xf2\x98\xfe\x8f\x05\x10\x12\x0eca_cert_sourceR\ttrustedCa\x12\xad\x01\n" +
	" ca_certificate_provider_instance\x18\r \x01(\v2L.envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstanceB\x16\xf2\x98\xfe\x8f\x05\x10\x12\x0eca_cert_sourceR\x1dcaCertificateProviderInstance\x12\x83\x01\n" +
	"\x11system_root_certs\x18\x11 \x01(\v2W.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCertsR\x0fsystemRootCerts\x12S\n" +
	"\x11watched_directory\x18\v \x01(\v2&.envoy.config.core.v3.WatchedDirectoryR\x10watchedDirectory\x12F\n" +
	"\x17verify_certificate_spki\x18\x03 \x03(\tB\x0e\xfaB\v\x92\x01\b\"\x06r\x04\x10,(,R\x15verifyCertificateSpki\x12F\n" +
	"\x17verify_certificate_hash\x18\x02 \x03(\tB\x0e\xfaB\v\x92\x01\b\"\x06r\x04\x10@(_R\x15verifyCertificateHash\x12\x82\x01\n" +
	"\x1dmatch_typed_subject_alt_names\x18\x0f \x03(\v2@.envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcherR\x19matchTypedSubjectAltNames\x12h\n" +
	"\x17match_subject_alt_names\x18\t \x03(\v2$.envoy.type.matcher.v3.StringMatcherB\v\x92ǆ\xd8\x04\x033.0\x18\x01R\x14matchSubjectAltNames\x12k\n" +
	"$require_signed_certificate_timestamp\x18\x06 \x01(\v2\x1a.google.protobuf.BoolValueR!requireSignedCertificateTimestamp\x122\n" +
	"\x03crl\x18\a \x01(\v2 .envoy.config.core.v3.DataSourceR\x03crl\x12:\n" +
	"\x19allow_expired_certificate\x18\b \x01(\bR\x17allowExpiredCertificate\x12\xa2\x01\n" +
	"\x18trust_chain_verification\x18\n" +
	" \x01(\x0e2^.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.TrustChainVerificationB\b\xfaB\x05\x82\x01\x02\x10\x01R\x16trustChainVerification\x12b\n" +
	"\x17custom_validator_config\x18\f \x01(\v2*.envoy.config.core.v3.TypedExtensionConfigR\x15customValidatorConfig\x128\n" +
	"\x19only_verify_leaf_cert_crl\x18\x0e \x01(\bR\x15onlyVerifyLeafCertCrl\x12O\n" +
	"\x10max_verify_depth\x18\x10 \x01(\v2\x1c.google.protobuf.UInt32ValueB\a\xfaB\x04*\x02\x18dR\x0emaxVerifyDepth\x1a\x11\n" +
	"\x0fSystemRootCerts\"F\n" +
	"\x16TrustChainVerification\x12\x16\n" +
	"\x12VERIFY_TRUST_CHAIN\x10\x00\x12\x14\n" +
	"\x10ACCEPT_UNTRUSTED\x10\x01:5\x9aň\x1e0\n" +
	".envoy.api.v2.auth.CertificateValidationContextJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x17verify_subject_alt_nameB\xa8\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"7io.envoyproxy.envoy.extensions.transport_sockets.tls.v3B\vCommonProtoP\x01ZVgithub.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3;tlsv3b\x06proto3"

var (
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescOnce sync.Once
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescData []byte
)

func file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescGZIP() []byte {
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDesc)))
	})
	return file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDescData
}

var file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
var file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
var file_envoy_extensions_transport_sockets_tls_v3_common_proto_goTypes = []any{
	(TlsParameters_TlsProtocol)(0),                           // 0: envoy.extensions.transport_sockets.tls.v3.TlsParameters.TlsProtocol
	(TlsParameters_CompliancePolicy)(0),                      // 1: envoy.extensions.transport_sockets.tls.v3.TlsParameters.CompliancePolicy
	(SubjectAltNameMatcher_SanType)(0),                       // 2: envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.SanType
	(CertificateValidationContext_TrustChainVerification)(0), // 3: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.TrustChainVerification
	(*TlsParameters)(nil),                                    // 4: envoy.extensions.transport_sockets.tls.v3.TlsParameters
	(*PrivateKeyProvider)(nil),                               // 5: envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider
	(*TlsCertificate)(nil),                                   // 6: envoy.extensions.transport_sockets.tls.v3.TlsCertificate
	(*TlsSessionTicketKeys)(nil),                             // 7: envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys
	(*CertificateProviderPluginInstance)(nil),                // 8: envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance
	(*SubjectAltNameMatcher)(nil),                            // 9: envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher
	(*CertificateValidationContext)(nil),                     // 10: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext
	(*CertificateValidationContext_SystemRootCerts)(nil),     // 11: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts
	(*anypb.Any)(nil),                                        // 12: google.protobuf.Any
	(*v3.DataSource)(nil),                                    // 13: envoy.config.core.v3.DataSource
	(*v3.WatchedDirectory)(nil),                              // 14: envoy.config.core.v3.WatchedDirectory
	(*v31.StringMatcher)(nil),                                // 15: envoy.type.matcher.v3.StringMatcher
	(*wrapperspb.BoolValue)(nil),                             // 16: google.protobuf.BoolValue
	(*v3.TypedExtensionConfig)(nil),                          // 17: envoy.config.core.v3.TypedExtensionConfig
	(*wrapperspb.UInt32Value)(nil),                           // 18: google.protobuf.UInt32Value
}
var file_envoy_extensions_transport_sockets_tls_v3_common_proto_depIdxs = []int32{
	0,  // 0: envoy.extensions.transport_sockets.tls.v3.TlsParameters.tls_minimum_protocol_version:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsParameters.TlsProtocol
	0,  // 1: envoy.extensions.transport_sockets.tls.v3.TlsParameters.tls_maximum_protocol_version:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsParameters.TlsProtocol
	1,  // 2: envoy.extensions.transport_sockets.tls.v3.TlsParameters.compliance_policies:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsParameters.CompliancePolicy
	12, // 3: envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider.typed_config:type_name -> google.protobuf.Any
	13, // 4: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.certificate_chain:type_name -> envoy.config.core.v3.DataSource
	13, // 5: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.private_key:type_name -> envoy.config.core.v3.DataSource
	13, // 6: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.pkcs12:type_name -> envoy.config.core.v3.DataSource
	14, // 7: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.watched_directory:type_name -> envoy.config.core.v3.WatchedDirectory
	5,  // 8: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.private_key_provider:type_name -> envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider
	13, // 9: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.password:type_name -> envoy.config.core.v3.DataSource
	13, // 10: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.ocsp_staple:type_name -> envoy.config.core.v3.DataSource
	13, // 11: envoy.extensions.transport_sockets.tls.v3.TlsCertificate.signed_certificate_timestamp:type_name -> envoy.config.core.v3.DataSource
	13, // 12: envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys.keys:type_name -> envoy.config.core.v3.DataSource
	2,  // 13: envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.san_type:type_name -> envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.SanType
	15, // 14: envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher.matcher:type_name -> envoy.type.matcher.v3.StringMatcher
	13, // 15: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca:type_name -> envoy.config.core.v3.DataSource
	8,  // 16: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.ca_certificate_provider_instance:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance
	11, // 17: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.system_root_certs:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts
	14, // 18: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.watched_directory:type_name -> envoy.config.core.v3.WatchedDirectory
	9,  // 19: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names:type_name -> envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher
	15, // 20: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.match_subject_alt_names:type_name -> envoy.type.matcher.v3.StringMatcher
	16, // 21: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.require_signed_certificate_timestamp:type_name -> google.protobuf.BoolValue
	13, // 22: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.crl:type_name -> envoy.config.core.v3.DataSource
	3,  // 23: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.trust_chain_verification:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.TrustChainVerification
	17, // 24: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.custom_validator_config:type_name -> envoy.config.core.v3.TypedExtensionConfig
	18, // 25: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.max_verify_depth:type_name -> google.protobuf.UInt32Value
	26, // [26:26] is the sub-list for method output_type
	26, // [26:26] is the sub-list for method input_type
	26, // [26:26] is the sub-list for extension type_name
	26, // [26:26] is the sub-list for extension extendee
	0,  // [0:26] is the sub-list for field type_name
}

func init() { file_envoy_extensions_transport_sockets_tls_v3_common_proto_init() }
func file_envoy_extensions_transport_sockets_tls_v3_common_proto_init() {
	if File_envoy_extensions_transport_sockets_tls_v3_common_proto != nil {
		return
	}
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes[1].OneofWrappers = []any{
		(*PrivateKeyProvider_TypedConfig)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_common_proto_rawDesc)),
			NumEnums:      4,
			NumMessages:   8,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_transport_sockets_tls_v3_common_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_transport_sockets_tls_v3_common_proto_depIdxs,
		EnumInfos:         file_envoy_extensions_transport_sockets_tls_v3_common_proto_enumTypes,
		MessageInfos:      file_envoy_extensions_transport_sockets_tls_v3_common_proto_msgTypes,
	}.Build()
	File_envoy_extensions_transport_sockets_tls_v3_common_proto = out.File
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_goTypes = nil
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_depIdxs = nil
}
