// GetServerTLSConfig returns a tls.Config for server use configured with the
// sign certificate, and a new certificate pool with the sign root certificate.
// The returned tls.Config will only verify the client certificate if provided.
// The server certificate will automatically rotate before expiring.
GetServerTLSConfig returns a tls.Config for server use configured with the
sign certificate, and a new certificate pool with the sign root certificate.
The returned tls.Config will only verify the client certificate if provided.
The server certificate will automatically rotate before expiring.
// GetServerTLSConfig returns a tls . Config for server use configured with the // sign certificate and a new certificate pool with the sign root certificate . // The returned tls . Config will only verify the client certificate if provided . // The server certificate will automatically rotate before expiring .
func (c *Client) GetServerTLSConfig(ctx context.Context, sign *api.SignResponse, pk crypto.PrivateKey, options ...TLSOption) (*tls.Config, error) {
	cert, err := TLSCertificate(sign, pk)
	if err != nil {
		return nil, err
	}
	renewer, err := NewTLSRenewer(cert, nil)
	if err != nil {
		return nil, err
	}
	tlsConfig := getDefaultTLSConfig(sign)
	tlsConfig.GetCertificate = renewer.GetCertificate
	tlsConfig.GetClientCertificate = renewer.GetClientCertificate
	tlsConfig.PreferServerCipherSuites = true
	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
	tlsCtx := newTLSOptionCtx(c, tlsConfig, sign)
	if err := tlsCtx.apply(options); err != nil {
		return nil, err
	}
	tlsConfig.GetConfigForClient = c.buildGetConfigForClient(tlsCtx)
	tr := getDefaultTransport(tlsConfig)
	tr.DialTLS = c.buildDialTLS(tlsCtx) 
	renewer.RenewCertificate = getRenewFunc(tlsCtx, c, tr, pk)
	c.SetTransport(tr)
	renewer.RunContext(ctx)
	return tlsConfig, nil
}
func ( c * Client ) GetServerTLSConfig ( ctx context . Context , sign * api . SignResponse , pk crypto . PrivateKey , options ... TLSOption ) ( * tls . Config , error ) { cert , err := TLSCertificate ( sign , pk ) if err != nil { return nil , err } renewer , err := NewTLSRenewer ( cert , nil ) if err != nil { return nil , err } tlsConfig := getDefaultTLSConfig ( sign ) tlsConfig . GetCertificate = renewer . GetCertificate tlsConfig . GetClientCertificate = renewer . GetClientCertificate tlsConfig . PreferServerCipherSuites = true tlsConfig . ClientAuth = tls . RequireAndVerifyClientCert tlsCtx := newTLSOptionCtx ( c , tlsConfig , sign ) if err := tlsCtx . apply ( options ) ; err != nil { return nil , err } tlsConfig . GetConfigForClient = c . buildGetConfigForClient ( tlsCtx ) tr := getDefaultTransport ( tlsConfig ) tr . DialTLS = c . buildDialTLS ( tlsCtx ) renewer . RenewCertificate = getRenewFunc ( tlsCtx , c , tr , pk ) c . SetTransport ( tr ) renewer . RunContext ( ctx ) return tlsConfig , nil }
GetServerTLSConfig returns a tls.Config for server use configured with the
sign certificate, and a new certificate pool with the sign root certificate.
GetServerTLSConfig returns a tls . Config for server use configured with the sign certificate and a new certificate pool with the sign root certificate .
// Note that GetCertificate will only be called if the client supplies SNI // information or if tlsConfig.Certificates is empty. // Without tlsConfig.Certificates there's not need to use tlsConfig.BuildNameToCertificate() // Apply options and initialize mutable tls.Config // GetConfigForClient allows seamless root and federated roots rotation. // If the return of the callback is not-nil, it will use the returned // tls.Config instead of the default one. // Update renew function with transport // Use mutable tls.Config on renew // nolint:staticcheck // tr.DialTLSContext = c.buildDialTLSContext(tlsCtx) // Update client transport // Start renewer