| 1 | package keyless |
| 2 | |
| 3 | import ( |
| 4 | "crypto/tls" |
| 5 | "errors" |
| 6 | "fmt" |
| 7 | "io" |
| 8 | "net/http" |
| 9 | |
| 10 | keylesstls "github.com/gosuda/keyless_tls/keyless" |
| 11 | ) |
| 12 | |
| 13 | type TLSMaterialConfig struct { |
| 14 | Keyless *RemoteSignerConfig |
| 15 | CertPEM []byte |
| 16 | KeyPEM []byte |
| 17 | EncryptedClientHelloKeys []tls.EncryptedClientHelloKey |
| 18 | } |
| 19 | |
| 20 | type RemoteSignerConfig struct { |
| 21 | Endpoint string |
| 22 | ServerName string |
| 23 | KeyID string |
| 24 | ClientCertPEM []byte |
| 25 | ClientKeyPEM []byte |
| 26 | RootCAPEM []byte |
| 27 | } |
| 28 | |
| 29 | func AttachToHTTPServer(server *http.Server, cfg TLSMaterialConfig) (io.Closer, error) { |
| 30 | if server == nil { |
| 31 | return nil, errors.New("http server is required") |
| 32 | } |
| 33 | if cfg.Keyless != nil { |
| 34 | minVersion := MinTLSVersion(len(cfg.EncryptedClientHelloKeys) > 0) |
| 35 | remoteSigner, err := keylesstls.AttachToHTTPServer(server, keylesstls.HTTPServerAttachConfig{ |
| 36 | CertPEM: cfg.CertPEM, |
| 37 | RemoteSigner: keylesstls.RemoteSignerConfig{ |
| 38 | Endpoint: cfg.Keyless.Endpoint, |
| 39 | ServerName: cfg.Keyless.ServerName, |
| 40 | KeyID: cfg.Keyless.KeyID, |
| 41 | ClientCertPEM: cfg.Keyless.ClientCertPEM, |
| 42 | ClientKeyPEM: cfg.Keyless.ClientKeyPEM, |
| 43 | RootCAPEM: cfg.Keyless.RootCAPEM, |
| 44 | }, |
| 45 | NextProtos: []string{"http/1.1"}, |
| 46 | MinTLSVersion: minVersion, |
| 47 | EncryptedClientHelloKeys: cfg.EncryptedClientHelloKeys, |
| 48 | }) |
| 49 | if err != nil { |
| 50 | return nil, err |
| 51 | } |
| 52 | return remoteSigner, nil |
| 53 | } |
| 54 | |
| 55 | cert, err := tls.X509KeyPair(cfg.CertPEM, cfg.KeyPEM) |
| 56 | if err != nil { |
| 57 | return nil, fmt.Errorf("parse api tls key pair: %w", err) |
| 58 | } |
| 59 | |
| 60 | minVersion := MinTLSVersion(len(cfg.EncryptedClientHelloKeys) > 0) |
| 61 | server.TLSConfig = &tls.Config{ |
| 62 | MinVersion: minVersion, |
| 63 | NextProtos: []string{"http/1.1"}, |
| 64 | Certificates: []tls.Certificate{cert}, |
| 65 | EncryptedClientHelloKeys: cfg.EncryptedClientHelloKeys, |
| 66 | } |
| 67 | return nil, nil |
| 68 | } |