Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow client certificates for mTLS connections #51

Open
plankton6 opened this issue Dec 15, 2022 · 0 comments
Open

Allow client certificates for mTLS connections #51

plankton6 opened this issue Dec 15, 2022 · 0 comments

Comments

@plankton6
Copy link

Hi, our infrastructure configures the vault server to require mTLS connections, which requires configuring client certificates for the http connection.

Also, our client certificates are encrypted with a passphrase, so they need to be decrypted before configuring them in the reqwest builder.

We started a contribution to this project (now closed), but soon we realised that it was not enough and the implementation was a bit trickier than expected, so we decided to use a custom Client in our side until this feature is fully supported here.

We are still aiming at helping with that, but it definitively requires some guidance from the maintainers:

  • How can we decrypt the certificates when the rustls feature is enabled?
  • In case that we leave the decryption out of this lib, is it ok to change String to be a Vec<u8> for the settings involving the client cert, key and passphrase? That would allow the client decrypt them and pass the raw bytes to the lib.
  • What about changing the ca_cert into a Vec<u8> in case we leave the reading of the CA stack to the user too?

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant