github-starred/newt
2
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-03-08 23:03:03 -05:00
Code Issues 21 Packages Projects Releases 25 Wiki Activity

Split mTLS client and CA certificates #33

New Issue
Closed
opened 2025-11-19 07:12:30 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-19 07:12:30 -06:00
Owner
Copy Link

Originally created by @3nprob on GitHub (Jun 5, 2025).

Currently, mTLS configuring reads private key + cert + CAs from a single file.

This conflates the client and server CA(s).

  • The local newt cert may be from a different CA that CAs that should be trusted for remote certs
    • We don't necessarily want to trust our own CA for remote certs
    • We may want to trust remote CAs that have no part in issuing the newt cert

Single-file bundle also a very commonly results in misconfiguration: Users will believe they need to include the CA for their own cert, as opposed to remote ones.

I suggest breaking up the configuration:

  • Make CA certificate optional in --tls-client-cert file
  • Add new configuration --tls-client-ca (can ideally be configured multiple times / a list to facilitate rotation without downtime)

Alternatively, deprecate tls-client-cert and add separate arguments for cert/key/cas.

Originally created by @3nprob on GitHub (Jun 5, 2025). Currently, mTLS configuring reads private key + cert + CAs from a single file. This conflates the client and server CA(s). - The local newt cert may be from a different CA that CAs that should be trusted for remote certs - We don't necessarily want to trust our own CA for remote certs - We may want to trust remote CAs that have no part in issuing the newt cert Single-file bundle also a very commonly results in misconfiguration: Users will believe they need to include the CA for their own cert, as opposed to remote ones. I suggest breaking up the configuration: - Make CA certificate optional in `--tls-client-cert` file - Add new configuration `--tls-client-ca` (can ideally be configured multiple times / a list to facilitate rotation without downtime) Alternatively, deprecate `tls-client-cert` and add separate arguments for cert/key/cas.
GiteaMirror added the good first issuehelp wanted labels 2025-11-19 07:12:30 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
good first issue
help wanted
Improvement
pull-request
Mirrored from GitHub Pull Request
No Label good first issue help wanted
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/newt#33
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?