By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR introduces a clearer separation between the mTLS client certificate/key and the CA certificate for the Newt service. The previous implementation used a single certificate path for both client authentication and CA verification. This change introduces the following:
--tls-client-cert-file: Path to the client certificate used for mTLS
--tls-client-key: Path to the private key associated with the client certificate
--tls-client-ca: Path to the CA certificate used to verify the server
Changes made:
Added three new CLI flags for TLS client certificate, key, and CA.
Ensured backward compatibility by not removing any existing functionality.
How to test?
Testing:
Local Docker environment used to simulate mTLS using generated client.key, client.crt, and ca.crt.
Verified failure when invalid paths are passed and success with correct certs.
Confirmed mutual TLS handshake is successful with valid certs.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/newt/pull/99
**Author:** [@Pallavikumarimdb](https://github.com/Pallavikumarimdb)
**Created:** 8/4/2025
**Status:** ✅ Merged
**Merged:** 8/31/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `feat/Split-mTLS-client-and-CA-certificates`
---
### 📝 Commits (1)
- [`d52f89f`](https://github.com/fosrl/newt/commit/d52f89f6296dbb46f20553e0f2dbbde5622c77e1) Split mTLS client and CA certificates
### 📊 Changes
**3 files changed** (+287 additions, -28 deletions)
<details>
<summary>View changed files</summary>
📝 `README.md` (+39 -8)
📝 `main.go` (+152 -9)
📝 `websocket/client.go` (+96 -11)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
This PR introduces a clearer separation between the mTLS client certificate/key and the CA certificate for the Newt service. The previous implementation used a single certificate path for both client authentication and CA verification. This change introduces the following:
* `--tls-client-cert-file`: Path to the client certificate used for mTLS
* `--tls-client-key`: Path to the private key associated with the client certificate
* `--tls-client-ca`: Path to the CA certificate used to verify the server
**Changes made**:
* Added three new CLI flags for TLS client certificate, key, and CA.
* Ensured backward compatibility by not removing any existing functionality.
## How to test?
**Testing**:
* Local Docker environment used to simulate mTLS using generated `client.key`, `client.crt`, and `ca.crt`.
* Verified failure when invalid paths are passed and success with correct certs.
* Confirmed mutual TLS handshake is successful with valid certs.
Closes #54
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/newt/pull/99
Author: @Pallavikumarimdb
Created: 8/4/2025
Status: ✅ Merged
Merged: 8/31/2025
Merged by: @oschwartz10612
Base:
main← Head:feat/Split-mTLS-client-and-CA-certificates📝 Commits (1)
d52f89fSplit mTLS client and CA certificates📊 Changes
3 files changed (+287 additions, -28 deletions)
View changed files
📝
README.md(+39 -8)📝
main.go(+152 -9)📝
websocket/client.go(+96 -11)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR introduces a clearer separation between the mTLS client certificate/key and the CA certificate for the Newt service. The previous implementation used a single certificate path for both client authentication and CA verification. This change introduces the following:
--tls-client-cert-file: Path to the client certificate used for mTLS--tls-client-key: Path to the private key associated with the client certificate--tls-client-ca: Path to the CA certificate used to verify the serverChanges made:
How to test?
Testing:
client.key,client.crt, andca.crt.Closes #54
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.