39 lines
760 B
Go
39 lines
760 B
Go
package secretsclient
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
func newMTLSClient(ca, cert, key string) (*http.Client, error) {
|
|
caPEMBytes, err := os.ReadFile(ca)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
caPool := x509.NewCertPool()
|
|
if !caPool.AppendCertsFromPEM(caPEMBytes) {
|
|
return nil, errors.New("could create a ca pool from file")
|
|
}
|
|
|
|
cliCert, err := tls.LoadX509KeyPair(cert, key)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not load client cert/key: %w", err)
|
|
}
|
|
|
|
return &http.Client{
|
|
// TODO: Tune other params.
|
|
Timeout: 10 * time.Second,
|
|
Transport: &http.Transport{
|
|
TLSClientConfig: &tls.Config{
|
|
RootCAs: caPool,
|
|
Certificates: []tls.Certificate{cliCert},
|
|
},
|
|
},
|
|
}, nil
|
|
}
|