Skip to content

Conversation

Matus-p
Copy link

@Matus-p Matus-p commented Aug 20, 2025

Loads the certificate chain and key from a file on every connection attempt.
This allows to dynamically reload certificate when it is renewed.

Loads the certificate chain and key from a file on every connection attempt.
This allows to dynamically reload certificate when it is renewed.
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
@kozlovic
Copy link
Member

@Matus-p Thank you for the quality PR. This approach - although less flexible (since the user is required to use the same cert file names, etc..) - would cause less friction.

I have used your branch and made some changes that I would like to see and pushed it. I did not create the PR out of that branch (yet) and wanted to see if you agree with the proposed changes (e827e77). You could either incorporate them in this PR or we create a PR out of the other branch. Your name/commit will be preserved. Once we decide on which direction to go, and once the changes are in place, I will enable to full PR CI tests to make sure we are not breaking anything.

@Matus-p
Copy link
Author

Matus-p commented Aug 20, 2025

@kozlovic similar approach is used in nats.go - they use the same cert file

I agree with proposed changes, thank you for that. Moreover i do not insist on function names, feel free to update them if needed.

One more thing that would need polishing is, that for test we need two different client certificates. I was not able to create one, because i do not have the CA key, so i used "server-key.pem" and "server-cert.pem". It works for testing purposes, but looks a bit ugly (in tlsverify.conf i had to use user "localhost", since there is no mail in SubjectAlternativeName section). It would be better to generate another client cert for "john@nats.io"

I had to regenerate the certificates in the process.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
@kozlovic
Copy link
Member

@Matus-p I added a new certificate (but had to regenerate the others in the process). I changed from john to Ivan if you don't mind ;-). If you want to pull the commit in this PR, please do so.

@Matus-p Matus-p force-pushed the feature/ssl_load_cert_dynamic branch from ab6b5c1 to 3a4c3c9 Compare August 20, 2025 23:06
Copy link
Member

@kozlovic kozlovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you for your contribution!

@kozlovic kozlovic merged commit 000b3e8 into nats-io:main Aug 21, 2025
38 of 42 checks passed
github-actions bot pushed a commit that referenced this pull request Aug 21, 2025
@Matus-p Matus-p deleted the feature/ssl_load_cert_dynamic branch August 27, 2025 11:59
github-actions bot pushed a commit to Matus-p/nats.c that referenced this pull request Aug 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants