By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR adds basic support for connecting to servers requiring a client certificate, aka mTLS.
Some restrictions for now (all documented):
only p12 and pfx formats
key, cert and ca cert must all be present
encryption is NOT supported ( because I couldn't find a go module to decrypt all formats without weird error messages that'd be difficult to debug for enduser
How to test?
I am planning on a PR against the pangolin repo too with similar contents, but first, newt :)
(This was tested only on macos so far)
Positive test
Have a pangolin deployment
Generate custom certs. If you want an example, check self-signed-certs-for-mtls.sh
Modify a pangolin server's Traefik dynamic_config.yaml by adding the following
http:routers:next-router:# ...tls:certResolver:letsencryptoptions:mtlsConfigapi-router:# ...tls:certResolver:letsencryptoptions:mtlsConfigws-router:# ...tls:certResolver:letsencryptoptions:mtlsConfigtls:options:mtlsConfig:clientAuth:clientAuthType:RequireAndVerifyClientCertcaFiles:- | -----BEGIN CERTIFICATE-----
.... <content of the ca.cert>
-----END CERTIFICATE-----
Add the generated client cert, eg alice-at-example-com.eng.12 to your client
On a mac
double click, import to KeyChain, using the password. (You could also just import the non-encrypted version)
Right click the imported item, Get Info
Open Trust
Set SSL to Always Trust
(Sry, haven't tested this on Linux or Windows, so can't describe )
Visit your admin pangolin portal using a browser supporting mTLS, and select the proposed cert.
Create a new Site, and copy the newt cli command
Start newt with the copied command, with the extra arg: --tls-client-cert=./certs/clients/alice-at-example-com.p12
Verify both in terminal and both in pangolin admin that the site is connected
Negative test
Same as above but run newt without the --tls-client-cert=... arg.
Verify error in terminal, explaining TLS connectivity issue.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/newt/pull/26
**Author:** [@progressive-kiwi](https://github.com/progressive-kiwi)
**Created:** 3/30/2025
**Status:** ✅ Merged
**Merged:** 4/3/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `dev` ← **Head:** `feat-mtls-support`
---
### 📝 Commits (7)
- [`623be5e`](https://github.com/fosrl/newt/commit/623be5ea0d00f33720c9df0428aa5be974a1b877) Merge pull request #20 from fosrl/dev
- [`f4e17a4`](https://github.com/fosrl/newt/commit/f4e17a4dd7cd754c2516f9d3b765056b0195657e) Merge pull request #22 from fosrl/dev
- [`2ff8df9`](https://github.com/fosrl/newt/commit/2ff8df9a8d6a7a5778b6af4b9100b59006c9e791) Merge branch 'dev'
- [`9b3c826`](https://github.com/fosrl/newt/commit/9b3c82648b1daa452423de3bb67e04e1f1612ba2) feat/mtls-support
- [`435b638`](https://github.com/fosrl/newt/commit/435b6387017ede59b3ab7423cefc7a3ec13ba4a7) feat/mtls-support-cert-script
- [`b41570e`](https://github.com/fosrl/newt/commit/b41570eb2ca5ac28ae30c929d885d556e7992744) feat/mtls-support-cert: config support
- [`d28e3ca`](https://github.com/fosrl/newt/commit/d28e3ca5e8ae3e15f67902c1dd0eda9d56670fb1) feat/mtls-support-cert: doc update, removing config.Endpoint loading duplicates, handling null-pointer case and some logging
### 📊 Changes
**9 files changed** (+290 additions, -31 deletions)
<details>
<summary>View changed files</summary>
📝 `.gitignore` (+4 -1)
📝 `README.md` (+35 -2)
📝 `go.mod` (+1 -0)
📝 `go.sum` (+2 -0)
📝 `main.go` (+25 -13)
➕ `self-signed-certs-for-mtls.sh` (+125 -0)
📝 `websocket/client.go` (+90 -11)
📝 `websocket/config.go` (+3 -0)
📝 `websocket/types.go` (+5 -4)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
This PR adds basic support for connecting to servers requiring a client certificate, aka mTLS.
Some restrictions for now (all documented):
* only p12 and pfx formats
* key, cert and ca cert must all be present
* encryption is NOT supported ( because I couldn't find a go module to decrypt all formats without weird error messages that'd be difficult to debug for enduser
## How to test?
I am planning on a PR against the pangolin repo too with similar contents, but first, `newt` :)
(This was tested only on macos so far)
### Positive test
1. Have a pangolin deployment
1. Generate custom certs. If you want an example, check `self-signed-certs-for-mtls.sh`
1. Modify a pangolin server's Traefik `dynamic_config.yaml` by adding the following
```yaml
http:
routers:
next-router:
# ...
tls:
certResolver: letsencrypt
options: mtlsConfig
api-router:
# ...
tls:
certResolver: letsencrypt
options: mtlsConfig
ws-router:
# ...
tls:
certResolver: letsencrypt
options: mtlsConfig
tls:
options:
mtlsConfig:
clientAuth:
clientAuthType: RequireAndVerifyClientCert
caFiles:
- |
-----BEGIN CERTIFICATE-----
.... <content of the ca.cert>
-----END CERTIFICATE-----
```
1. Add the generated client cert, eg `alice-at-example-com.eng.12` to your client
* On a **mac**
1. double click, import to KeyChain, using the password. (You could also just import the non-encrypted version)
2. Right click the imported item, `Get Info`
3. Open `Trust`
4. Set `SSL` to `Always Trust`
* (Sry, haven't tested this on Linux or Windows, so can't describe )
1. Visit your admin pangolin portal using a browser supporting mTLS, and select the proposed cert.
1. Create a new Site, and copy the newt cli command
2. Start newt with the copied command, with the extra arg: `--tls-client-cert=./certs/clients/alice-at-example-com.p12`
3. Verify both in terminal and both in pangolin admin that the site is connected
### Negative test
1. Same as above but run newt without the `--tls-client-cert=...` arg.
2. Verify error in terminal, explaining TLS connectivity issue.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/newt/pull/26
Author: @progressive-kiwi
Created: 3/30/2025
Status: ✅ Merged
Merged: 4/3/2025
Merged by: @oschwartz10612
Base:
dev← Head:feat-mtls-support📝 Commits (7)
623be5eMerge pull request #20 from fosrl/devf4e17a4Merge pull request #22 from fosrl/dev2ff8df9Merge branch 'dev'9b3c826feat/mtls-support435b638feat/mtls-support-cert-scriptb41570efeat/mtls-support-cert: config supportd28e3cafeat/mtls-support-cert: doc update, removing config.Endpoint loading duplicates, handling null-pointer case and some logging📊 Changes
9 files changed (+290 additions, -31 deletions)
View changed files
📝
.gitignore(+4 -1)📝
README.md(+35 -2)📝
go.mod(+1 -0)📝
go.sum(+2 -0)📝
main.go(+25 -13)➕
self-signed-certs-for-mtls.sh(+125 -0)📝
websocket/client.go(+90 -11)📝
websocket/config.go(+3 -0)📝
websocket/types.go(+5 -4)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR adds basic support for connecting to servers requiring a client certificate, aka mTLS.
Some restrictions for now (all documented):
How to test?
I am planning on a PR against the pangolin repo too with similar contents, but first,
newt:)(This was tested only on macos so far)
Positive test
self-signed-certs-for-mtls.shdynamic_config.yamlby adding the followingalice-at-example-com.eng.12to your clientGet InfoTrustSSLtoAlways Trust--tls-client-cert=./certs/clients/alice-at-example-com.p12Negative test
--tls-client-cert=...arg.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.