Function TLSConfig

cert/source.go:95–151

TLSConfig creates a tls.Config which sets the GetCertificate field to a certificate store which uses the given source to update the the certificates on-demand. It also sets the ClientCAs field if src.LoadClientCAs returns a non-nil value and sets ClientAuth to RequireAndVerifyClientCert.

(src Source, strictMatch bool, minVersion, maxVersion uint16, cipherSuites []uint16)

// It also sets the ClientCAs field if src.LoadClientCAs returns a non-nil
// value and sets ClientAuth to RequireAndVerifyClientCert.
func TLSConfig(src Source, strictMatch bool, minVersion, maxVersion uint16, cipherSuites []uint16) (*tls.Config, error) {
	clientCAs, err := src.LoadClientCAs()
	if err != nil {
		return nil, err
	}

	sf := &singleflight.Group{}
	store := NewStore()
	x := &tls.Config{
		MinVersion:   minVersion,
		MaxVersion:   maxVersion,
		CipherSuites: cipherSuites,
		NextProtos:   []string{"h2", "http/1.1"},
		GetCertificate: func(clientHello *tls.ClientHelloInfo) (cert *tls.Certificate, err error) {
			cert, err = getCertificate(store.certstore(), clientHello, strictMatch)
			if cert != nil {
				return
			}

			switch err {
			case nil, ErrNoCertsStored:
				// Store doesn't contain a suitable cert. Perhaps the source can issue one?
			default:
				// an unrecoverable error
				return
			}

			ca, ok := src.(Issuer)
			if !ok {
				return
			}

			serverName := clientHello.ServerName
			x, err, _ := sf.Do(serverName, func() (any, error) {
				return ca.Issue(serverName)
			})
			if err != nil {
				return cert, err
			}

			return x.(*tls.Certificate), nil
		},
	}

	if clientCAs != nil {
		x.ClientCAs = clientCAs
		x.ClientAuth = tls.RequireAndVerifyClientCert
	}

	go func() {
		for certs := range src.Certificates() {
			store.SetCertificates(certs)
		}
	}()

	return x, nil
}