[fixes 31700] Add mTLS support for http backend by way of client cert & key, as well as enterprise cacert.

[scr-oath]

For any http servers that require mTLS (client certificates), as well as using custom cacert rather than skipping cert validation altogether, add the following settings:

• cacert: verify server certs using this trust file
• cert: provide a public cert from the client to server
• key: sign the public cert and all TLS traffic with a private key

[hashicorp-cla]

All committers have signed the CLA.

[crw]

Thanks for this submission!

[kmoe]

Thank you for this PR. I'd appreciate if you could provide a guide for manually testing this change.

[apparentlymart]

Some general naming comments below! I've not closely reviewed the actual code because @kmoe is already on that. 😀

[scr-oath]

Thank you for this PR. I'd appreciate if you could provide a guide for manually testing this change.

Well… I did put a unit test in there, which describes its usage - I teased out the "self-signed" certificate used in httptest and wrote its pem files out to use for trust of the server (since it's self signed it is the CA as well), and to present to the server as client cert.

I guess to test this manually… one would create a cert that's used ONLY for the CA, then create a server cert and a client cert that's signed by that… then add that to the RootCAs of the client and the ClientCAs of the server as well as check assumptions about the principals' reported Common Name (CN field of subject).

This technique would thwart the chicken-and-egg issue I had with using the test cert - that is, in order to get the cert, I needed to fire up the server, but in order to add to the ClientCAs, one would need to know the signing cert up front… which could be more easily done if that cert were known ahead of time and configured in the server before starting it in the ClientCAs field as well as set the ClientAuth value of the servers tls.Config to RequireAndVerifyClientCert rather than the RequireAnyClientCert which I used due to not having this signing cert available before starting the server.

[Magnitus-]

Thank you for this PR. I'd appreciate if you could provide a guide for manually testing this change.

I'm going on vacation on the 21th and I have things to wrap up at work before I go, but on my return, I could publish a test setup with our etcd backend if you like. I want this change :)

[scr-oath]

Hi - we started using the s3+dynamo solution for a few needs so this lost urgency for me.

But... I thought I had added a test to show the use of it... I'll try to make that test more specifically about this, if not also document setting up outside of test, as well as address the naming convention comments so this can merge.

[scr-oath]

FWIW, I had to force push to make the license appear signed (I recall reading that commits made prior to adding a user address don't get tied to your account) so rebasing and pushing seemed to have solved that

[scr-oath]

Thanks for making the requested changes. The testify library appears in go.sum because it is used by one of Terraform Core's dependencies, but it is not used in the Core codebase itself (go mod why github.com/stretchr/testify). We've found that having human-readable context in test failures is helpful when debugging..

Ok - I removed use of testify and now go.mod does not contain reference to it again.

[scr-oath]

Please also rebase your branch against main.

Done - rebased and force pushed - now all changes appear directly from the merge-base (no merges)

[Magnitus-]

Any news?

[kmoe]

Thanks for your patience. Happy to merge this - will be available in the next 1.4 alpha for testing.

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.