/
tls.go
50 lines (42 loc) · 1.31 KB
/
tls.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
package statsdaemon
import (
"crypto/tls"
"crypto/x509"
"fmt"
"os"
)
func getTLSConfiguration(caPath, certPath, keyPath string, enable bool) (*tls.Config, error) {
if !enable {
return nil, nil
}
tlsConfig := &tls.Config{
// Can't use SSLv3 because of POODLE and BEAST
// Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher
// Can't use TLSv1.1 because of RC4 cipher usage
MinVersion: tls.VersionTLS12,
}
if caPath != "" {
caPEM, err := os.ReadFile(caPath)
if err != nil {
return nil, fmt.Errorf("[%s] error reading TLS CA: %v", BackendName, err)
}
tlsConfig.RootCAs = x509.NewCertPool()
if ok := tlsConfig.RootCAs.AppendCertsFromPEM(caPEM); !ok {
return nil, fmt.Errorf("[%s] error reading TLS CA: no certificates found", BackendName)
}
}
if certPath != "" || keyPath != "" {
if certPath == "" {
return nil, fmt.Errorf("[%s] tls_cert_path is required when tls_key_path is set", BackendName)
}
if keyPath == "" {
return nil, fmt.Errorf("[%s] tls_key_path is required when tls_cert_path is set", BackendName)
}
cert, err := tls.LoadX509KeyPair(certPath, keyPath)
if err != nil {
return nil, fmt.Errorf("[%s] error loading client certificate: %v", BackendName, err)
}
tlsConfig.Certificates = append(tlsConfig.Certificates, cert)
}
return tlsConfig, nil
}