Function createServerTLSConfig

http/server_factory.go:49–65

(config config.HTTPServerConfiguration, certs *config.HTTPServerCerts)

}

func createServerTLSConfig(config config.HTTPServerConfiguration, certs *config.HTTPServerCerts) *tls.Config {
	// We let users configure the minimum TLS version, so we don't need gosec here.
	tlsConfig := &tls.Config{ //nolint:gosec
		MinVersion:               config.TLSVersion.GetTLSVersion(),
		CurvePreferences:         config.ECDHCurves.GetList(),
		PreferServerCipherSuites: true,
		CipherSuites:             config.CipherSuites.GetList(),
	}

	tlsConfig.Certificates = []tls.Certificate{*certs.Cert}

	if certs.ClientCAPool != nil {
		tlsConfig.ClientCAs = certs.ClientCAPool
		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
	}
	return tlsConfig
}