Function NewTLSConfigWithContext

config/http_config.go:1263–1321

NewTLSConfigWithContext creates a new tls.Config from the given TLSConfig.

(ctx context.Context, cfg *TLSConfig, optFuncs ...TLSConfigOption)

// NewTLSConfigWithContext creates a new tls.Config from the given TLSConfig.
func NewTLSConfigWithContext(ctx context.Context, cfg *TLSConfig, optFuncs ...TLSConfigOption) (*tls.Config, error) {
	opts := tlsConfigOptions{}
	for _, opt := range optFuncs {
		opt.applyToTLSConfigOptions(&opts)
	}

	if err := cfg.Validate(); err != nil {
		return nil, err
	}

	tlsConfig := &tls.Config{
		InsecureSkipVerify: cfg.InsecureSkipVerify,
		MinVersion:         uint16(cfg.MinVersion),
		MaxVersion:         uint16(cfg.MaxVersion),
	}

	if cfg.MaxVersion != 0 && cfg.MinVersion != 0 {
		if cfg.MaxVersion < cfg.MinVersion {
			return nil, errors.New("tls_config.max_version must be greater than or equal to tls_config.min_version if both are specified")
		}
	}

	// If a CA cert is provided then let's read it in so we can validate the
	// scrape target's certificate properly.
	caSecret, err := toSecret(opts.secretManager, Secret(cfg.CA), cfg.CAFile, cfg.CARef)
	if err != nil {
		return nil, fmt.Errorf("unable to use CA cert: %w", err)
	}
	if caSecret != nil {
		ca, err := caSecret.Fetch(ctx)
		if err != nil {
			return nil, fmt.Errorf("unable to read CA cert: %w", err)
		}
		if !updateRootCA(tlsConfig, []byte(ca)) {
			return nil, fmt.Errorf("unable to use specified CA cert %s", caSecret.Description())
		}
	}

	if len(cfg.ServerName) > 0 {
		tlsConfig.ServerName = cfg.ServerName
	}

	// If a client cert & key is provided then configure TLS config accordingly.
	if cfg.usingClientCert() && cfg.usingClientKey() {
		// Verify that client cert and key are valid.
		if _, err := cfg.getClientCertificate(ctx, opts.secretManager); err != nil {
			return nil, err
		}
		tlsConfig.GetClientCertificate = func(cri *tls.CertificateRequestInfo) (*tls.Certificate, error) {
			var ctx context.Context
			if cri != nil {
				ctx = cri.Context()
			}
			return cfg.getClientCertificate(ctx, opts.secretManager)
		}
	}

	return tlsConfig, nil