feat(httpclient): trust additional CA certs from a directory#4359
Open
reinkrul wants to merge 7 commits into
Open
feat(httpclient): trust additional CA certs from a directory#4359reinkrul wants to merge 7 commits into
reinkrul wants to merge 7 commits into
Conversation
Add the httpclient.tls.extracertsdir config option. When set, all *.pem and *.crt files in the directory are loaded and added to the HTTP client trust bundle, on top of the OS CA bundle. Subject and SHA-256 fingerprint of each certificate are logged. A configured-but-missing directory or an invalid certificate file is a hard error at startup. The Docker image creates /etc/nuts/http-trust.d and sets NUTS_HTTPCLIENT_TLS_EXTRACERTSDIR by default, so CAs can be dropped in via a volume mount without rebuilding the image. Closes #4285 Assisted by AI
Contributor
|
Coverage Impact ⬆️ Merging this pull request will increase total coverage on Modified Files with Diff Coverage (3)
🤖 Increase coverage with AI coding...🚦 See full report on Qlty Cloud » 🛟 Help
|
Add a test that starts an HTTPS server with a certificate signed by a custom CA, confirms the client rejects it, then trusts it after loading the CA via ConfigureTrustBundle. Assisted by AI
The background refresh loop started by setupModule's Start() calls ListDIDs on the subject when its registration is due, racing with the subtest's own GetServiceActivation call and exceeding the Times(1) expectation. Disable the loop in this subtest, matching the sibling 'activated, with VP' subtest. Assisted by AI
Note the default /etc/nuts/http-trust.d directory and the NUTS_HTTPCLIENT_TLS_EXTRACERTSDIR env var in the Docker volume mounts section. Assisted by AI
Log whether each loaded certificate is a root CA, intermediate CA or a non-CA certificate, mirroring core.BuildTrustStore's classification. They all share the single client RootCAs pool (a TLS client has no separate intermediates pool); the distinction is informational for audit. Assisted by AI
reinkrul
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
stevenvegt and
woutslakhorst
as code owners
Assisted by AI
Assisted by AI
Contributor
0 new issues
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4285
Summary
The outbound HTTP client trusted only the OS CA bundle, so trusting an extra CA (e.g. the AORTA-GtK issuer) required rebuilding the Docker image with the cert baked in. This adds a config option to load additional CA certificates from a directory at startup.
Changes
httpclient.tls.extracertsdir. When set, all*.pemand*.crtfiles in the directory are parsed and added to the HTTP client trust bundle, on top of the OS CA bundle. Each cert is logged with its subject, SHA-256 fingerprint and type (root CA / intermediate CA / certificate) for audit.http.Engine.configureClient, mutating the sharedclient.SafeHttpTransportroot pool. Affects the general clients (client.New/NewWithCache)./etc/nuts/http-trust.d(owned by the nuts user) and setsNUTS_HTTPCLIENT_TLS_EXTRACERTSDIRby default → drop PEM/CRT files in via a volume mount, no rebuild.server_options.rstrow, documented the trust dir / env var in the Docker deployment guide, and regenerated config docs (make cli-docs)..pem+.crt, non-existent dir, non-cert extension ignored, malformed cert), cert classification, flag parsing, and an end-to-end test that stands up an HTTPS server with a custom-CA cert and verifies the client only connects after the CA is loaded.Behavior
Scope notes
tls.truststorefile) — out of scope per the issue.RootCAs); intermediates presented by the server are used for chain building during the handshake. All loaded certs go into that one pool (same as the gRPC truststore); the root/intermediate split is informational in the logs.NewWithTLSConfig, OpenID4VCI) replaces the whole TLS config and is intentionally unaffected.🤖 Assisted by AI