Function createTLSConfig

http/client_factory.go:46–64

createTLSConfig creates a TLS config. Should only be called after config.Validate().

(config config.HTTPClientConfiguration, certs *config.HTTPClientCerts)

// createTLSConfig creates a TLS config. Should only be called after config.Validate().
func createTLSConfig(config config.HTTPClientConfiguration, certs *config.HTTPClientCerts) *tls.Config {
	if !strings.HasPrefix(config.URL, "https://") {
		return nil
	}

	// We let users configure the minimum TLS version, so we don't need gosec here.
	tlsConfig := &tls.Config{ //nolint:gosec
		MinVersion:       config.TLSVersion.GetTLSVersion(),
		CurvePreferences: config.ECDHCurves.GetList(),
		CipherSuites:     config.CipherSuites.GetList(),
	}
	if certs.CACertPool != nil {
		tlsConfig.RootCAs = certs.CACertPool
	}
	if certs.Cert != nil {
		tlsConfig.Certificates = []tls.Certificate{*certs.Cert}
	}
	return tlsConfig
}