github-starred/newt
2
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-05-06 07:59:04 -05:00
Code Issues 227 Packages Projects Releases 40 Wiki Activity

[GH-ISSUE #54] Split mTLS client and CA certificates #2003

New Issue
Closed
opened 2026-05-03 05:41:47 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-05-03 05:41:47 -05:00
Owner
Copy Link

Originally created by @3nprob on GitHub (Jun 5, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/54

Currently, mTLS configuring reads private key + cert + CAs from a single file.

This conflates the client and server CA(s).

  • The local newt cert may be from a different CA that CAs that should be trusted for remote certs
    • We don't necessarily want to trust our own CA for remote certs
    • We may want to trust remote CAs that have no part in issuing the newt cert

Single-file bundle also a very commonly results in misconfiguration: Users will believe they need to include the CA for their own cert, as opposed to remote ones.

I suggest breaking up the configuration:

  • Make CA certificate optional in --tls-client-cert file
  • Add new configuration --tls-client-ca (can ideally be configured multiple times / a list to facilitate rotation without downtime)

Alternatively, deprecate tls-client-cert and add separate arguments for cert/key/cas.

Originally created by @3nprob on GitHub (Jun 5, 2025). Original GitHub issue: https://github.com/fosrl/newt/issues/54 Currently, mTLS configuring reads private key + cert + CAs from a single file. This conflates the client and server CA(s). - The local newt cert may be from a different CA that CAs that should be trusted for remote certs - We don't necessarily want to trust our own CA for remote certs - We may want to trust remote CAs that have no part in issuing the newt cert Single-file bundle also a very commonly results in misconfiguration: Users will believe they need to include the CA for their own cert, as opposed to remote ones. I suggest breaking up the configuration: - Make CA certificate optional in `--tls-client-cert` file - Add new configuration `--tls-client-ca` (can ideally be configured multiple times / a list to facilitate rotation without downtime) Alternatively, deprecate `tls-client-cert` and add separate arguments for cert/key/cas.
GiteaMirror added the good first issuehelp wanted labels 2026-05-03 05:41:47 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
dependencies
enhancement
good first issue
help wanted
Improvement
needs investigating
pull-request
Mirrored from GitHub Pull Request
 stale
wontfix
No Label good first issue help wanted
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/newt#2003
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?