Skip to content

feat: support new tls.ca-file field #1124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

feat: support new tls.ca-file field #1124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
69f59ca
feat: support new tls.ca-file field
May 29, 2025
3120198
doc: update tls section
May 29, 2025
ce5ba86
test: add negative test cases
May 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,6 +440,7 @@ the client used to send the request.
| `client.identity-aware-proxy.audience` | The Identity-Aware-Proxy audience. (client-id of the IAP oauth2 credential) | required `""` |
| `client.tls.certificate-file` | Path to a client certificate (in PEM format) for mTLS configurations. | `""` |
| `client.tls.private-key-file` | Path to a client private key (in PEM format) for mTLS configurations. | `""` |
| `client.tls.ca-file` | Path to a root CA (in PEM format) for mTLS configurations. | `""` |
| `client.tls.renegotiation` | Type of renegotiation support to provide. (`never`, `freely`, `once`). | `"never"` |
| `client.network` | The network to use for ICMP endpoint client (`ip`, `ip4` or `ip6`). | `"ip"` |

Expand Down Expand Up @@ -525,6 +526,7 @@ endpoints:
tls:
certificate-file: /path/to/user_cert.pem
private-key-file: /path/to/user_key.pem
ca-file: /path/to/root-ca.pem
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you specify in the table that ca-file is optional for non-self-signed certificate authorities, and a similar comment in the yaml example next to ca-file: /path/to/root-ca.pem?

For verbosity, I want devs to keep their configuration as simple as possible, and by adding these comments, I hope it'll make it more clear that this isn't required unless it's an unrecognized/self-signed CA

renegotiation: once
conditions:
- "[STATUS] == 200"
Expand Down
19 changes: 19 additions & 0 deletions client/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,12 @@ package client
import (
"context"
"crypto/tls"
"crypto/x509"
"errors"
"net"
"net/http"
"net/url"
"os"
"regexp"
"strconv"
"time"
Expand Down Expand Up @@ -106,6 +108,9 @@ type TLSConfig struct {
// PrivateKeyFile is the private key file for TLS in PEM format.
PrivateKeyFile string `yaml:"private-key-file,omitempty"`

// CAFile is the CA certificate file for TLS in PEM format.
CAFile string `yaml:"ca-file,omitempty"`

RenegotiationSupport string `yaml:"renegotiation,omitempty"`
}

Expand Down Expand Up @@ -198,6 +203,12 @@ func (t *TLSConfig) isValid() error {
if err != nil {
return err
}
if len(t.CAFile) > 0 {
_, err := os.ReadFile(t.CAFile)
if err != nil {
return err
}
}
return nil
}
return ErrInvalidClientTLSConfig
Expand Down Expand Up @@ -330,6 +341,14 @@ func configureTLS(tlsConfig *tls.Config, c TLSConfig) *tls.Config {
return nil
}
tlsConfig.Certificates = []tls.Certificate{clientTLSCert}

if c.CAFile != "" {
caCert, _ := os.ReadFile(c.CAFile)
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
tlsConfig.RootCAs = caCertPool
}

tlsConfig.Renegotiation = tls.RenegotiateNever
renegotiationSupport := map[string]tls.RenegotiationSupport{
"once": tls.RenegotiateOnceAsClient,
Expand Down
10 changes: 10 additions & 0 deletions client/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,11 +118,21 @@ func TestConfig_TlsIsValid(t *testing.T) {
cfg: &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key"}},
expectedErr: false,
},
{
name: "good-tls-with-ca-config",
cfg: &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key", CAFile: "../testdata/cert.pem"}},
expectedErr: false,
},
{
name: "missing-certificate-file",
cfg: &Config{TLS: &TLSConfig{CertificateFile: "doesnotexist", PrivateKeyFile: "../testdata/cert.key"}},
expectedErr: true,
},
{
name: "missing-ca-file",
cfg: &Config{TLS: &TLSConfig{CertificateFile: "../testdata/cert.pem", PrivateKeyFile: "../testdata/cert.key", CAFile: "doesnotexist"}},
expectedErr: true,
},
{
name: "bad-certificate-file",
cfg: &Config{TLS: &TLSConfig{CertificateFile: "../testdata/badcert.pem", PrivateKeyFile: "../testdata/cert.key"}},
Expand Down