Skip to content

feat: present a client certificate for mutual TLS - #16

Merged
DavidCozens merged 1 commit into
mainfrom
stage-16-mtls
Aug 16, 2026
Merged

feat: present a client certificate for mutual TLS#16
DavidCozens merged 1 commit into
mainfrom
stage-16-mtls

Conversation

@DavidCozens

Copy link
Copy Markdown
Contributor

Add a client certificate and its key to the stream config. The handshake then authenticates the
device to the collector, as well as the collector to the device.

struct SolidSyslogMbedTlsStreamConfig tlsConfig = {
    /* ... as the previous TLS stage ... */
    .ClientCertChain = DeviceCertStore_ClientChain(),
    .ClientKey       = DeviceCertStore_ClientKey(),
};

Both fields must be set. Supplying one and not the other leaves the connection
server-authenticated and does not fail, so the pipeline element is given what the device holds
rather than what was configured:

s_sd[3] = SyslogPipelineSd_Init((clientChain != NULL) && (clientKey != NULL));
... [logPipeline@32473 transport="mtls" atRest="hmac-sha256"] device started

The handshake authenticates the TLS peer. Where a relay, gateway or broker terminates the
connection, the collector authenticates that hop rather than the device behind it, and the origin
element carries the device's own identity across it.

The collector port used here requires a client certificate and refuses a client that presents none.

When you need it. When the receiver has to authenticate the device rather than accept the
identity the record claims. It requires a certificate per device, protected storage for the private
key, and an issuing and revocation process behind both.

@DavidCozens

Copy link
Copy Markdown
Contributor Author

@coderabbitai pause

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8b96b1b1-0451-4f12-bd6b-b8c2513efdec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Note

Reviews paused

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown
✅ Action performed

Reviews paused.

@DavidCozens
DavidCozens force-pushed the stage-15-pipeline-sd branch from 29a36ee to bfc82fd Compare August 16, 2026 21:51
ClientCertChain and ClientKey join the stream config, and the collector moves to
6515. The device authenticates itself to the collector as well as verifying it.

  Flash        +13,624 B     (+68 on the previous stage)
  RAM          +39,524 B  (+2,052)
  mbedTLS peak +15,892 B  (37,220 absolute)
  Log stack       +680 B  (unchanged)
  Service       +3,768 B  (unchanged)

Both handles come from the cert store, which has parsed them since boot, so no
provisioning or parsing is charged here.

The mbedTLS pool moves from 53 to 55 KiB, following this device's existing rule
of peak times 1.5 rounded up to the next KiB. The run passes without the resize;
the margin is for fragmentation.

Both credentials must be set: either one NULL disables mTLS and the connection
falls back to server authentication without failing. The pipeline element is
therefore given what the device holds rather than what was configured.

Port 6515 requires a client certificate, and scripts/smoke-oracle.sh shows it
refusing a client that presents none.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@DavidCozens
DavidCozens changed the base branch from stage-15-pipeline-sd to main August 16, 2026 21:51
@DavidCozens
DavidCozens merged commit fd88572 into main Aug 16, 2026
1 check was pending
@DavidCozens
DavidCozens deleted the stage-16-mtls branch August 16, 2026 21:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant