41 lines
831 B
Go
41 lines
831 B
Go
package tls
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"errors"
|
|
"io/ioutil"
|
|
)
|
|
|
|
// LoadTLSConfig loads the certificate from cert & key files and optional client CA file.
|
|
func LoadTLSConfig(certFile, keyFile, caFile string) (*tls.Config, error) {
|
|
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
cfg := &tls.Config{Certificates: []tls.Certificate{cert}}
|
|
|
|
if pool, _ := loadCA(caFile); pool != nil {
|
|
cfg.ClientCAs = pool
|
|
cfg.ClientAuth = tls.RequireAndVerifyClientCert
|
|
}
|
|
|
|
return cfg, nil
|
|
}
|
|
|
|
func loadCA(caFile string) (cp *x509.CertPool, err error) {
|
|
if caFile == "" {
|
|
return
|
|
}
|
|
cp = x509.NewCertPool()
|
|
data, err := ioutil.ReadFile(caFile)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !cp.AppendCertsFromPEM(data) {
|
|
return nil, errors.New("AppendCertsFromPEM failed")
|
|
}
|
|
return
|
|
}
|