30 lines
760 B
Go
30 lines
760 B
Go
package secretsserver
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"errors"
|
|
"os"
|
|
)
|
|
|
|
// mTLSConfigFromCA returns a tls config that enforces client auth with certs
|
|
// issued by the provided ca.
|
|
func mTLSConfigFromCA(ca string) (*tls.Config, error) {
|
|
caPEMBytes, err := os.ReadFile(ca)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
caCertPool := x509.NewCertPool()
|
|
if added := caCertPool.AppendCertsFromPEM(caPEMBytes); !added {
|
|
return nil, errors.New("ca file did not contain a valid cert")
|
|
}
|
|
return &tls.Config{
|
|
// Force server to deman and verify cert from clients.
|
|
ClientAuth: tls.RequireAndVerifyClientCert,
|
|
// CAs that will be used to verify client certs.
|
|
ClientCAs: caCertPool,
|
|
// Safer to default to tls 1.3
|
|
MinVersion: tls.VersionTLS13,
|
|
}, nil
|
|
}
|