Repository navigation
Accept a CA certificate, and client certificates for mTLS - #2
Merged
Merged
Conversation
`tls: true` called createSsl() with no arguments, so the client could only reach a server whose certificate chains to a public root. A self-hosted Priompt is normally fronted by a private CA — which is exactly what the Go CLI's -ca-cert and the Python client's ca_cert exist for. This client had no equivalent, so TLS deployments were unreachable from Node entirely. Adds caCert, and clientCert/clientKey for a server started with -client-ca, which refuses connections lacking a certificate signed by that CA before authentication runs. All three are file paths; the cert and key must be given together, and that is checked up front rather than surfacing later as an opaque handshake failure. Verified against real TLS and mTLS servers: connects with the CA, is refused without it, connects with a valid client certificate, and is refused both without one and with one signed by a different CA.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tls: truecalledcreateSsl()with no arguments, so this client could only reach a server whose certificate chains to a public root. A self-hosted Priompt is normally fronted by a private CA — which is exactly what the Go CLI's-ca-certand the Python client'sca_certexist for. This client had no equivalent, so TLS deployments were unreachable from Node entirely.Adds
caCert, plusclientCert/clientKeyfor a server started with-client-ca. All three are file paths; cert and key must be given together, checked up front.Verified against real TLS and mTLS servers: connects with the CA, refused without it, connects with a valid client cert, refused both without one and with one signed by a different CA.