Add TLS File Path Options for MySQL Database Connection #5121

New Issue

GiteaMirror · 2025-11-02T06:15:04-06:00

GiteaMirror commented

2025-11-02 06:15:04 -06:00

Originally created by @bagasme on GitHub (Mar 26, 2020).

Description

Currently connecting Gitea to MySQL database over TLS only supports one-way TLS, (that is only database server can be verified by TLS). To enable two-way TLS (both client and server can be verified), passing client credentials (client certificate, its private key, and CA certificates) are required. This can be accomplished by defining custom tls.Config handler as per driver documentation.

Path to client credentials should be added to app.ini. The corresponding app.ini entry, SSL_MODE must be set to verify-client (tls.Config custom handler) to enable this option.

Originally created by @bagasme on GitHub (Mar 26, 2020). ## Description Currently connecting Gitea to MySQL database over TLS only supports one-way TLS, (that is only database server can be verified by TLS). To enable two-way TLS (both client and server can be verified), passing client credentials (client certificate, its private key, and CA certificates) are required. This can be accomplished by defining custom `tls.Config` handler as per [driver documentation](https://pkg.go.dev/github.com/go-sql-driver/mysql?tab=doc#RegisterTLSConfig). Path to client credentials should be added to `app.ini`. The corresponding `app.ini` entry, `SSL_MODE` must be set to `verify-client` (`tls.Config` custom handler) to enable this option.

GiteaMirror added the issue/confirmed type/enhancement labels 2025-11-02 06:15:04 -06:00

GiteaMirror commented

2025-11-02 06:15:05 -06:00

@stale[bot] commented on GitHub (May 25, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (May 25, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror commented

2025-11-02 06:15:05 -06:00

@mshedsilegx commented on GitHub (Jun 25, 2024):

Can that be considered to be implemented ? it is a blocker for us as our mysql server is configured with 2-way TLS (due to our security policy):

Require trusted client certificates
- Only allows connections from clients that use a valid client certificate and SSL encryption

@mshedsilegx commented on GitHub (Jun 25, 2024): Can that be considered to be implemented ? it is a blocker for us as our mysql server is configured with 2-way TLS (due to our security policy): * Require trusted client certificates - Only allows connections from clients that use a valid client certificate and SSL encryption

GiteaMirror referenced this issue

2025-11-02 14:46:05 -06:00

[PR #5121] [MERGED] Remove duplicated if bodies #17653

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5121