Function LoadClientTLSConfig

x/tls_helper.go:166–214

LoadClientTLSConfig loads the TLS config into the client with the given parameters.

(v *viper.Viper)

// LoadClientTLSConfig loads the TLS config into the client with the given parameters.
func LoadClientTLSConfig(v *viper.Viper) (*tls.Config, error) {
	if v.GetString("slash_grpc_endpoint") != "" {
		return SlashTLSConfig(v.GetString("slash_grpc_endpoint"))
	}

	tlsFlag := z.NewSuperFlag(v.GetString("tls")).MergeAndCheckDefault(TLSDefaults)

	// When the --tls ca-cert="..."; option is specified, the connection will be set up using TLS
	// instead of plaintext. However the client cert files are optional, depending on whether the
	// server requires a client certificate.
	caCert := tlsFlag.GetPath("ca-cert")
	if caCert != "" {
		tlsCfg := tls.Config{
			MinVersion: tls.VersionTLS12,
		}

		// 1. set up the root CA
		pool, err := generateCertPool(caCert, tlsFlag.GetBool("use-system-ca"))
		if err != nil {
			return nil, err
		}
		tlsCfg.RootCAs = pool

		// 2. set up the server name for verification
		tlsCfg.ServerName = tlsFlag.GetString("server-name")

		// 3. optionally load the client cert files
		certFile := tlsFlag.GetPath("client-cert")
		keyFile := tlsFlag.GetPath("client-key")
		if certFile != "" && keyFile != "" {
			cert, err := tls.LoadX509KeyPair(certFile, keyFile)
			if err != nil {
				return nil, err
			}
			tlsCfg.Certificates = []tls.Certificate{cert}
		}

		return &tlsCfg, nil
	} else
	// Attempt to determine if user specified *any* TLS option. Unfortunately and contrary to
	// Viper's own documentation, there's no way to tell whether an option value came from a
	// command-line option or a built-it default.
	if tlsFlag.GetString("server-name") != "" ||
		tlsFlag.GetPath("client-cert") != "" ||
		tlsFlag.GetPath("client-key") != "" {
		return nil, errors.Errorf(`--tls "ca-cert=...;" is required for enabling TLS`)
	}
	return nil, nil
}

func generateCertPool(certPath string, useSystemCA bool) (*x509.CertPool, error) {
	var pool *x509.CertPool