a08a3b9 feat(Docs): Add License Badge and PkgGo Badge
c673743 Merge pull request #142 from marcschaeferger/main
9bd96ac Support TLS_CLIENT_CERT, TLS_CLIENT_KEY and TLS_CA_CERT in Docker Compose
📊 Changes
2 files changed (+4 additions, -1 deletions)
View changed files
📝README.md (+3 -0) 📝main.go (+1 -1)
📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
In our Docker Compose setup for mTLS, the recommended configuration is to pass the three PEM-based variables:
TLS_CLIENT_CERT
TLS_CLIENT_KEY
TLS_CA_CERT
However, the current code path has an unintended fallback: when TLS_CLIENT_CERT_PKCS12 is unset or empty, it automatically treats TLS_CLIENT_CERT as the certificate source and ignores TLS_CLIENT_KEY and TLS_CA_CERT even if they are provided. This makes the PEM triplet unusable and forces a pseudo-PKCS#12 behavior when it shouldn’t.
Observed error / symptom
TLS configuration error: cannot use both PKCS12 format (--tls-client-cert) and separate certificate files (--tls-client-cert-file, --tls-client-key, --tls-client-ca)
Important scope note (not affected)
This issue does not occur when running the binary directly with CLI flags, e.g.:
With explicit flags, the PEM triplet works as expected. The problem is specific to the environment-variable–driven configuration commonly used in Docker Compose.
How to test?
PEM triplet via Docker Compose
Create three test files (client.crt, client.key, ca.crt).
Run the service with:
Expected: both PEM triplet and PKCS#12 paths work; when PKCS#12 is unset, the PEM triplet is honored.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/newt/pull/143
**Author:** [@rgutmen](https://github.com/rgutmen)
**Created:** 9/19/2025
**Status:** ✅ Merged
**Merged:** 9/20/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `dev` ← **Head:** `mlts-pkcs12-compatibility`
---
### 📝 Commits (4)
- [`0fc13be`](https://github.com/fosrl/newt/commit/0fc13be413b356768c7840baef0b64599b16518e) feat(Docs): Addding GoReport Badge
- [`a08a3b9`](https://github.com/fosrl/newt/commit/a08a3b96659816cfeb0dea84f5e00be8cb630f37) feat(Docs): Add License Badge and PkgGo Badge
- [`c673743`](https://github.com/fosrl/newt/commit/c673743692d0f8c66f31d288977a7fbf4d079df2) Merge pull request #142 from marcschaeferger/main
- [`9bd96ac`](https://github.com/fosrl/newt/commit/9bd96ac5401de68f04eb7270f24295a0d63236db) Support TLS_CLIENT_CERT, TLS_CLIENT_KEY and TLS_CA_CERT in Docker Compose
### 📊 Changes
**2 files changed** (+4 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `README.md` (+3 -0)
📝 `main.go` (+1 -1)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
In our Docker Compose setup for mTLS, the recommended configuration is to pass the three PEM-based variables:
- TLS_CLIENT_CERT
- TLS_CLIENT_KEY
- TLS_CA_CERT
However, the current code path has an unintended fallback: when TLS_CLIENT_CERT_PKCS12 is unset or empty, it automatically treats TLS_CLIENT_CERT as the certificate source and ignores TLS_CLIENT_KEY and TLS_CA_CERT even if they are provided. This makes the PEM triplet unusable and forces a pseudo-PKCS#12 behavior when it shouldn’t.
#### Observed error / symptom
```bash
TLS configuration error: cannot use both PKCS12 format (--tls-client-cert) and separate certificate files (--tls-client-cert-file, --tls-client-key, --tls-client-ca)
```
### Important scope note (not affected)
This issue does not occur when running the binary directly with CLI flags, e.g.:
```bash
docker run ... \
--tls-client-cert-file /tls/client.crt \
--tls-client-key /tls/client.key \
--tls-client-ca /tls/ca.crt
```
With explicit flags, the PEM triplet works as expected. The problem is specific to the environment-variable–driven configuration commonly used in Docker Compose.
## How to test?
### PEM triplet via Docker Compose
Create three test files (client.crt, client.key, ca.crt).
Run the service with:
```yml
volumes:
- /opt/newt/tls:/tls:ro
environment:
- PANGOLIN_ENDPOINT=my.endpoint.com
- TLS_CLIENT_CERT=/tls/newt.crt
- TLS_CLIENT_KEY=/tls/newt.key
- TLS_CA_CERT=/tls/server-ca.pem
- NEWT_ID=iw3c.....
- NEWT_SECRET=cc9tny.....
```
### PKCS#12 via Docker Compose
Create a client.p12 (same material as above).
Run the service with:
```yml
volumes:
- /opt/newt/tls:/tls:ro
environment:
- PANGOLIN_ENDPOINT=my.endpoint.com
- TLS_CLIENT_CERT_PKCS12=/tls/client.p12
- NEWT_ID=iw3c.....
- NEWT_SECRET=cc9tny.....
```
Expected: both PEM triplet and PKCS#12 paths work; when PKCS#12 is unset, the PEM triplet is honored.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/newt/pull/143
Author: @rgutmen
Created: 9/19/2025
Status: ✅ Merged
Merged: 9/20/2025
Merged by: @oschwartz10612
Base:
dev← Head:mlts-pkcs12-compatibility📝 Commits (4)
0fc13befeat(Docs): Addding GoReport Badgea08a3b9feat(Docs): Add License Badge and PkgGo Badgec673743Merge pull request #142 from marcschaeferger/main9bd96acSupport TLS_CLIENT_CERT, TLS_CLIENT_KEY and TLS_CA_CERT in Docker Compose📊 Changes
2 files changed (+4 additions, -1 deletions)
View changed files
📝
README.md(+3 -0)📝
main.go(+1 -1)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
In our Docker Compose setup for mTLS, the recommended configuration is to pass the three PEM-based variables:
However, the current code path has an unintended fallback: when TLS_CLIENT_CERT_PKCS12 is unset or empty, it automatically treats TLS_CLIENT_CERT as the certificate source and ignores TLS_CLIENT_KEY and TLS_CA_CERT even if they are provided. This makes the PEM triplet unusable and forces a pseudo-PKCS#12 behavior when it shouldn’t.
Observed error / symptom
Important scope note (not affected)
This issue does not occur when running the binary directly with CLI flags, e.g.:
With explicit flags, the PEM triplet works as expected. The problem is specific to the environment-variable–driven configuration commonly used in Docker Compose.
How to test?
PEM triplet via Docker Compose
Create three test files (client.crt, client.key, ca.crt).
Run the service with:
PKCS#12 via Docker Compose
Create a client.p12 (same material as above).
Run the service with:
Expected: both PEM triplet and PKCS#12 paths work; when PKCS#12 is unset, the PEM triplet is honored.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.