Make use of SocketCAFile config

[hyde-zhang]

I think the SocketUseSSL config actually makes the code skips the SocketCAFile config when it is set to Y.

Since we have SocketCAFile option to use a supplied CA certificate to verify server identity, we still need the part of the code to add the supplied CA certificate to the CertPool and other functionalities. Skipping client authentication shouldn't skip everything.

[ackleymi]

@hyde-zhang Add a test or two around this in tls_test.go

[ackleymi]

Use go test -v -timeout=15s -count=1 -run TLSTestSuite as a shortcut to only execute tls tests

[hyde-zhang]

@ackleymi Thanks for looking into this.

Since the acceptor and initiator uses the same loadTLSConfig function, updated the patch a bit such that:

• TLS config will be created if:

  • As long as the settings has either pk or certificate entry set (might be incomplete)
  • Or no key pair setting at all but skip (SSL) client certs is allowed

  ---

  • The client certificates of TLS config will only be loaded if key and certificate both valid, but TLS config can still be loaded.
  • Initiator will be able to use TLS without its own pk and certs
  • Acceptor will skip client certs verification during hand shake if SocketUseSSL = Y i.e. when initiator is not providing any thing to verify
  • Acceptor can potentially start without setting its own pk and certs but this will be checked by crypto/tls. Again maybe initiator and acceptor shouldn't be using the same loadTLSConfig function.

• I found the SocketUseSSL config name a bit confusing as it is really just allowSkipClientCerts.

[hyde-zhang]

Still need to verify the incoming message using host's root CA set i.e. only skip when SocketUseSSL = Y - when initiator is allowed to not providing key pairs for its own identify

[hyde-zhang]

@ackleymi Updated previous comments. Found it was a bit confusing. Sorry about that.

[hyde-zhang]

Hey @ackleymi, any chance we can get this merged so that when initiator needs to use a custom CA file it can set SocketUseSSL=Y and only supply SocketCAFile (i.e. without setting SocketPrivateKeyFile and SocketCertificateFile)

[hyde-zhang]

@ackleymi thanks