mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-10 08:37:00 +02:00
Code Issues Projects Releases Wiki Activity

Make CA certificate optional in ClientTLSConfig

Browse Source
This commit is contained in:
Jeff Mitchell 2019-06-23 21:17:39 -04:00
parent f8a1ac2791
commit 68b40b814c
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sdk/helper/tlsutil/tlsutil.go
View File

@ -72,16 +72,19 @@ func GetCipherName(cipher uint16) (string, error) {
func ClientTLSConfig(caCert []byte, clientCert []byte, clientKey []byte) (*tls.Config, error) {
var tlsConfig *tls.Config
var pool *x509.CertPool
switch {
case len(caCert) != 0 && len(clientCert) != 0 && len(clientKey) != 0:
case len(clientCert) != 0 && len(clientKey) != 0:
// Valid
case len(caCert) != 0, len(clientCert) != 0, len(clientKey) != 0:
default:
return nil, ErrInvalidCertParams
}
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(caCert)
if len(caCert) != 0 {
pool = x509.NewCertPool()
pool.AppendCertsFromPEM(caCert)
}
cert, err := tls.X509KeyPair(clientCert, clientKey)
if err != nil {