Function TestClientTLSConfig

test/conn_test.go:239–340

(t *testing.T)

}

func TestClientTLSConfig(t *testing.T) {
	s, opts := RunServerWithConfig("./configs/tlsverify.conf")
	defer s.Shutdown()

	endpoint := fmt.Sprintf("%s:%d", opts.Host, opts.Port)
	secureURL := fmt.Sprintf("nats://%s", endpoint)

	// Make sure this fails
	nc, err := nats.Connect(secureURL, nats.Secure())
	if err == nil {
		nc.Close()
		t.Fatal("Should have failed (TLS) connection without client certificate")
	}
	cert, err := os.ReadFile("./configs/certs/client-cert.pem")
	if err != nil {
		t.Fatal("Failed to read client certificate")
	}
	key, err := os.ReadFile("./configs/certs/client-key.pem")
	if err != nil {
		t.Fatal("Failed to read client key")
	}
	rootCAs, err := os.ReadFile("./configs/certs/ca.pem")
	if err != nil {
		t.Fatal("Failed to read root CAs")
	}

	certCB := func() (tls.Certificate, error) {
		cert, err := tls.X509KeyPair(cert, key)
		if err != nil {
			return tls.Certificate{}, fmt.Errorf("nats: error loading client certificate: %w", err)
		}
		cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])
		if err != nil {
			return tls.Certificate{}, fmt.Errorf("nats: error parsing client certificate: %w", err)
		}
		return cert, nil
	}

	caCB := func() (*x509.CertPool, error) {
		pool := x509.NewCertPool()
		ok := pool.AppendCertsFromPEM(rootCAs)
		if !ok {
			return nil, errors.New("nats: failed to parse root certificate from")
		}
		return pool, nil
	}

	// Check parameters validity
	_, err = nats.Connect(secureURL, nats.ClientTLSConfig(nil, nil))
	if !errors.Is(err, nats.ErrClientCertOrRootCAsRequired) {
		t.Fatalf("Expected error %q, got %q", nats.ErrClientCertOrRootCAsRequired, err)
	}

	certErr := &tls.CertificateVerificationError{}
	// Should fail because of missing CA
	_, err = nats.Connect(secureURL,
		nats.ClientCert("./configs/certs/client-cert.pem", "./configs/certs/client-key.pem"))
	if ok := errors.As(err, &certErr); !ok {