CreateDERPMeshTLSConfig creates a TLS configuration for connecting to peers in the DERP mesh over private networking. It overrides the ServerName to be the expected public hostname of the peer, and trusts all of the TLS server certificates used by this replica (as we expect all replicas to use the s
(hostname string, tlsCertificates []tls.Certificate)
| 498 | // certificates used by this replica (as we expect all replicas to use the same |
| 499 | // TLS certificates). |
| 500 | func CreateDERPMeshTLSConfig(hostname string, tlsCertificates []tls.Certificate) (*tls.Config, error) { |
| 501 | meshRootCA := x509.NewCertPool() |
| 502 | for _, certificate := range tlsCertificates { |
| 503 | for _, certificatePart := range certificate.Certificate { |
| 504 | parsedCert, err := x509.ParseCertificate(certificatePart) |
| 505 | if err != nil { |
| 506 | return nil, xerrors.Errorf("parse certificate %s: %w", parsedCert.Subject.CommonName, err) |
| 507 | } |
| 508 | meshRootCA.AddCert(parsedCert) |
| 509 | } |
| 510 | } |
| 511 | |
| 512 | // This TLS configuration trusts the built-in TLS certificates and forces |
| 513 | // the server name to be the public hostname. |
| 514 | return &tls.Config{ |
| 515 | MinVersion: tls.VersionTLS12, |
| 516 | RootCAs: meshRootCA, |
| 517 | ServerName: hostname, |
| 518 | }, nil |
| 519 | } |