Skip to content

replace the tls layer in config key path with flat key names #337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lstruman merged 1 commit into from
Aug 11, 2026
Merged

replace the tls layer in config key path with flat key names #337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 30 additions & 26 deletions config/sample_webconfig.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,19 +184,21 @@ webconfig {
is_ssl_enabled = true

// TLS/SSL configuration (optional when is_ssl_enabled = true)
// If tls block is not provided or incomplete, will use insecure TLS
tls {
// Client certificate for mutual TLS (mTLS) - optional
cert_file = "/path/to/client-cert.pem"
key_file = "/path/to/client-key.pem"

// CA certificate for server verification - optional
ca_cert_file = "/path/to/ca-cert.pem"

// Skip certificate verification (INSECURE - for testing only)
// When true, allows TLS without certificates or CA validation
insecure_skip_verify = false
}
// Client certificate for mutual TLS (mTLS) - optional
tls_cert_file = "/path/to/client-cert.pem"
tls_key_file = "/path/to/client-key.pem"

// CA certificate for server verification - optional
tls_ca_cert_file = "/path/to/ca-cert.pem"

// Skip certificate verification (INSECURE - for testing only)
// When true, allows TLS without certificates or CA validation
tls_insecure_skip_verify = false

// Override SNI hostname sent during TLS handshake.
// Required when the certificate uses DNS SANs only (no IP SANs).
// Leave empty to use the host IP address (gocql default).
tls_server_name = ""
}

yugabyte {
Expand All @@ -218,19 +220,21 @@ webconfig {
is_ssl_enabled = true

// TLS/SSL configuration (optional when is_ssl_enabled = true)
// If tls block is not provided or incomplete, will use insecure TLS
tls {
// Client certificate for mutual TLS (mTLS) - optional
cert_file = "/path/to/client-cert.pem"
key_file = "/path/to/client-key.pem"

// CA certificate for server verification - optional
ca_cert_file = "/path/to/ca-cert.pem"

// Skip certificate verification (INSECURE - for testing only)
// When true, allows TLS without certificates or CA validation
insecure_skip_verify = false
}
// Client certificate for mutual TLS (mTLS) - optional
tls_cert_file = "/path/to/client-cert.pem"
tls_key_file = "/path/to/client-key.pem"

// CA certificate for server verification - optional
tls_ca_cert_file = "/path/to/ca-cert.pem"

// Skip certificate verification (INSECURE - for testing only)
// When true, allows TLS without certificates or CA validation
tls_insecure_skip_verify = false

// Override SNI hostname sent during TLS handshake.
// Required when the certificate uses DNS SANs only (no IP SANs).
// Leave empty to use the host IP address (gocql default).
tls_server_name = ""
}
}

Expand Down
18 changes: 9 additions & 9 deletions db/cassandra/cassandra_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,8 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl
}

if isSslEnabled {
tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver)
insecureSkipVerify := dbconf.GetBoolean("tls_insecure_skip_verify")
tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver, insecureSkipVerify)
if err != nil {
Comment on lines 147 to 150
return nil, common.NewError(err)
}
Expand Down Expand Up @@ -196,15 +197,13 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl

// loadCassandraTLSConfig loads TLS configuration for Cassandra connection.
// Returns a tls.Config with certificates loaded from the configuration.
// The function expects tls.{} block under the database driver config (cassandra or yugabyte).
func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string) (*tls.Config, error) {
// Check insecure_skip_verify flag first
insecureSkipVerify := dbconf.GetBoolean("tls.insecure_skip_verify")

// Reads flat tls_* keys directly under the database driver config (cassandra or yugabyte).
func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string, insecureSkipVerify bool) (*tls.Config, error) {
// Load client certificates for mTLS if provided (optional when insecure_skip_verify is true)
certFile := dbconf.GetString("tls.cert_file")
keyFile := dbconf.GetString("tls.key_file")
caCertFile := dbconf.GetString("tls.ca_cert_file")
certFile := dbconf.GetString("tls_cert_file")
keyFile := dbconf.GetString("tls_key_file")
caCertFile := dbconf.GetString("tls_ca_cert_file")
serverName := dbconf.GetString("tls_server_name")
Comment on lines +201 to +206

// Create TLS config for Cassandra connection.
// Prefer modern ECDHE+AEAD suites for forward secrecy; keep TLS_RSA_WITH_AES_128_CBC_SHA
Expand All @@ -222,6 +221,7 @@ func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string) (*tls
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
},
InsecureSkipVerify: insecureSkipVerify,
ServerName: serverName,
}

// When insecure_skip_verify is true and no cert files configured, skip loading certificates
Expand Down
Loading