Method ensureTLSConfig

cli/root.go:626–670

ensureTLSConfig loads the TLS configuration from files if specified. The resulting config is used for both API requests and DERP connections. If tlsConfig is already set programmatically, file-based configuration is skipped.

()

// The resulting config is used for both API requests and DERP connections.
// If tlsConfig is already set programmatically, file-based configuration is skipped.
func (r *RootCmd) ensureTLSConfig() error {
	// Already loaded or programmatically set - skip file loading
	if r.tlsConfig != nil {
		return nil
	}

	// No TLS config needed
	if r.tlsCAFile == "" && r.tlsClientCertFile == "" && r.tlsClientKeyFile == "" {
		return nil
	}

	// Validate that cert and key are specified together
	if (r.tlsClientCertFile == "") != (r.tlsClientKeyFile == "") {
		return xerrors.Errorf("--%s and --%s must be specified together", varClientTLSCertFile, varClientTLSKeyFile)
	}

	tlsConfig := &tls.Config{
		MinVersion: tls.VersionTLS12,
	}

	// Load CA certificate if specified
	if r.tlsCAFile != "" {
		caData, err := os.ReadFile(r.tlsCAFile)
		if err != nil {
			return xerrors.Errorf("read TLS CA file %q: %w", r.tlsCAFile, err)
		}
		caPool := x509.NewCertPool()
		if !caPool.AppendCertsFromPEM(caData) {
			return xerrors.Errorf("failed to parse CA certificate in %q", r.tlsCAFile)
		}
		tlsConfig.RootCAs = caPool
	}

	// Load client certificate if specified
	if r.tlsClientCertFile != "" && r.tlsClientKeyFile != "" {
		cert, err := tls.LoadX509KeyPair(r.tlsClientCertFile, r.tlsClientKeyFile)
		if err != nil {
			return xerrors.Errorf("load TLS client certificate: %w", err)
		}
		tlsConfig.Certificates = []tls.Certificate{cert}
	}

	r.tlsConfig = tlsConfig
	return nil
}

// InitClient creates and configures a new client with authentication, telemetry,
// and version checks.