Method getClientCertificate

config/http_config.go:1427–1461

getClientCertificate reads the pair of client cert and key and returns a tls.Certificate.

(ctx context.Context, secretManager SecretManager)

// getClientCertificate reads the pair of client cert and key and returns a tls.Certificate.
func (c *TLSConfig) getClientCertificate(ctx context.Context, secretManager SecretManager) (*tls.Certificate, error) {
	var (
		certData, keyData string
		err               error
	)

	certSecret, err := toSecret(secretManager, Secret(c.Cert), c.CertFile, c.CertRef)
	if err != nil {
		return nil, fmt.Errorf("unable to use client cert: %w", err)
	}
	if certSecret != nil {
		certData, err = certSecret.Fetch(ctx)
		if err != nil {
			return nil, fmt.Errorf("unable to read specified client cert: %w", err)
		}
	}

	keySecret, err := toSecret(secretManager, c.Key, c.KeyFile, c.KeyRef)
	if err != nil {
		return nil, fmt.Errorf("unable to use client key: %w", err)
	}
	if keySecret != nil {
		keyData, err = keySecret.Fetch(ctx)
		if err != nil {
			return nil, fmt.Errorf("unable to read specified client key: %w", err)
		}
	}

	cert, err := tls.X509KeyPair([]byte(certData), []byte(keyData))
	if err != nil {
		return nil, fmt.Errorf("unable to use specified client cert (%s) & key (%s): %w", certSecret.Description(), keySecret.Description(), err)
	}

	return &cert, nil
}

// updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs.
func updateRootCA(cfg *tls.Config, b []byte) bool {