Build an HTTPS client with mTLS.
(
pki: &PkiBundle,
)
| 104 | |
| 105 | /// Build an HTTPS client with mTLS. |
| 106 | fn https_client_mtls( |
| 107 | pki: &PkiBundle, |
| 108 | ) -> Client< |
| 109 | hyper_rustls::HttpsConnector<hyper_util::client::legacy::connect::HttpConnector>, |
| 110 | Empty<Bytes>, |
| 111 | > { |
| 112 | let roots = build_tls_root(&pki.ca_cert_pem); |
| 113 | let client_certs = { |
| 114 | let mut cursor = std::io::Cursor::new(&pki.client_cert_pem); |
| 115 | certs(&mut cursor) |
| 116 | .collect::<Result<Vec<CertificateDer<'static>>, _>>() |
| 117 | .expect("failed to parse client cert pem") |
| 118 | }; |
| 119 | let client_key = { |
| 120 | let mut cursor = std::io::Cursor::new(&pki.client_key_pem); |
| 121 | rustls_pemfile::private_key(&mut cursor) |
| 122 | .expect("failed to parse client key pem") |
| 123 | .expect("no private key found") |
| 124 | }; |
| 125 | let tls_config = rustls::ClientConfig::builder() |
| 126 | .with_root_certificates(roots) |
| 127 | .with_client_auth_cert(client_certs, client_key) |
| 128 | .expect("failed to build client TLS config with client cert"); |
| 129 | let https = HttpsConnectorBuilder::new() |
| 130 | .with_tls_config(tls_config) |
| 131 | .https_only() |
| 132 | .enable_http1() |
| 133 | .build(); |
| 134 | Client::builder(TokioExecutor::new()).build(https) |
| 135 | } |
| 136 | |
| 137 | /// Build an HTTPS client *without* a client cert (simulates Cloudflare tunnel). |
| 138 | fn https_client_no_cert( |
no test coverage detected