1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
|
/*
Copyright 2019 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package util
import (
"crypto/tls"
"crypto/x509"
"fmt"
"os"
"path/filepath"
)
// getCACertPool loads CA certificates to pool
func getCACertPool(caFile string) (*x509.CertPool, error) {
certPool := x509.NewCertPool()
caCert, err := os.ReadFile(filepath.Clean(caFile))
if err != nil {
return nil, fmt.Errorf("failed to read CA cert %s: %v", caFile, err)
}
ok := certPool.AppendCertsFromPEM(caCert)
if !ok {
return nil, fmt.Errorf("failed to append CA cert to the cert pool")
}
return certPool, nil
}
// GetClientTLSConfig returns tlsConfig based on x509 certs
func GetClientTLSConfig(caFile, certFile, keyFile, serverName string, protos []string) (*tls.Config, error) {
certPool, err := getCACertPool(caFile)
if err != nil {
return nil, err
}
tlsConfig := &tls.Config{
RootCAs: certPool,
MinVersion: tls.VersionTLS12,
}
if len(protos) != 0 {
tlsConfig.NextProtos = protos
}
if certFile == "" && keyFile == "" {
// return TLS config based on CA only
return tlsConfig, nil
}
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
if err != nil {
return nil, fmt.Errorf("failed to load X509 key pair %s and %s: %v", certFile, keyFile, err)
}
tlsConfig.ServerName = serverName
tlsConfig.Certificates = []tls.Certificate{cert}
return tlsConfig, nil
}
|