config: don't require CA to be configured when rotating client cert

config/generate.go

@@ -217,6 +217,16 @@ func main() {
 		log.Fatal(err)
 	}
 
+	log.Println("Generating second client certificate")
+	cert, key, err = GenerateCertificate(caCert, caKey, false, "localhost")
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if err := writeCertificateAndKey("testdata/client2", cert, key); err != nil {
+		log.Fatal(err)
+	}
+
 	log.Println("Generating self-signed client certificate")
 	cert, key, err = GenerateCertificate(nil, nil, false, "localhost")
 	if err != nil {

config/http_config.go

@@ -1484,11 +1484,10 @@ func (t *tlsRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	// The cert and key files are read separately by the client
 	// using GetClientCertificate.
 	tlsConfig := t.tlsConfig.Clone()
-	if !updateRootCA(tlsConfig, caData) {
-		if t.settings.CA == nil {
-			return nil, errors.New("unable to use specified CA cert: none configured")
+	if t.settings.CA != nil {
+		if !updateRootCA(tlsConfig, caData) {
+			return nil, fmt.Errorf("unable to use specified CA cert %s", t.settings.CA.Description())
 		}
-		return nil, fmt.Errorf("unable to use specified CA cert %s", t.settings.CA.Description())
 	}
 	rt, err = t.newRT(tlsConfig)
 	if err != nil {

config/http_config_test.go

@@ -41,18 +41,20 @@ import (
 )
 
 const (
-	TLSCAChainPath        = "testdata/tls-ca-chain.pem"
-	ServerCertificatePath = "testdata/server.crt"
-	ServerKeyPath         = "testdata/server.key"
-	ClientCertificatePath = "testdata/client.crt"
-	ClientKeyNoPassPath   = "testdata/client.key"
-	InvalidCA             = "testdata/client.key"
-	WrongClientCertPath   = "testdata/self-signed-client.crt"
-	WrongClientKeyPath    = "testdata/self-signed-client.key"
-	EmptyFile             = "testdata/empty"
-	MissingCA             = "missing/ca.crt"
-	MissingCert           = "missing/cert.crt"
-	MissingKey            = "missing/secret.key"
+	TLSCAChainPath         = "testdata/tls-ca-chain.pem"
+	ServerCertificatePath  = "testdata/server.crt"
+	ServerKeyPath          = "testdata/server.key"
+	ClientCertificatePath  = "testdata/client.crt"
+	ClientKeyNoPassPath    = "testdata/client.key"
+	Client2CertificatePath = "testdata/client2.crt"
+	Client2KeyNoPassPath   = "testdata/client2.key"
+	InvalidCA              = "testdata/client.key"
+	WrongClientCertPath    = "testdata/self-signed-client.crt"
+	WrongClientKeyPath     = "testdata/self-signed-client.key"
+	EmptyFile              = "testdata/empty"
+	MissingCA              = "missing/ca.crt"
+	MissingCert            = "missing/cert.crt"
+	MissingKey             = "missing/secret.key"
 
 	ExpectedMessage                   = "I'm here to serve you!!!"
 	ExpectedError                     = "expected error"
@@ -1014,6 +1016,8 @@ func getCertificateBlobs(t *testing.T) map[string][]byte {
 		TLSCAChainPath,
 		ClientCertificatePath,
 		ClientKeyNoPassPath,
+		Client2CertificatePath,
+		Client2KeyNoPassPath,
 		ServerCertificatePath,
 		ServerKeyPath,
 		WrongClientCertPath,
@@ -2067,7 +2071,7 @@ func TestModifyTLSCertificates(t *testing.T) {
 func TestTLSRoundTripper_NoCAConfigured(t *testing.T) {
 	bs := getCertificateBlobs(t)
 
-	tmpDir, err := os.MkdirTemp("", "tlspanic")
+	tmpDir, err := os.MkdirTemp("", "tlsroundtrippernoca")
 	require.NoErrorf(t, err, "Failed to create tmp dir")
 	defer os.RemoveAll(tmpDir)
 	cert, key := filepath.Join(tmpDir, "cert"), filepath.Join(tmpDir, "key")
@@ -2079,6 +2083,24 @@ func TestTLSRoundTripper_NoCAConfigured(t *testing.T) {
 	require.NoError(t, err)
 	defer testServer.Close()
 
+	tests := []struct {
+		cert string
+		key  string
+
+		errMsg string
+	}{
+		{
+			cert: Client2CertificatePath,
+			key:  Client2KeyNoPassPath,
+		},
+		{
+			cert: EmptyFile,
+			key:  ClientKeyNoPassPath,
+
+			errMsg: "unable to use specified client cert",
+		},
+	}
+
 	cfg := HTTPClientConfig{
 		TLSConfig: TLSConfig{
 			CertFile:           cert,
@@ -2087,23 +2109,50 @@ func TestTLSRoundTripper_NoCAConfigured(t *testing.T) {
 		},
 	}
 
-	writeCertificate(bs, ClientCertificatePath, cert)
-	writeCertificate(bs, ClientKeyNoPassPath, key)
-	c, err := NewClientFromConfig(cfg, "test")
-	require.NoErrorf(t, err, "Error creating HTTP Client: %v", err)
+	var c *http.Client
+	for i, tc := range tests {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			writeCertificate(bs, ClientCertificatePath, cert)
+			writeCertificate(bs, ClientKeyNoPassPath, key)
+			if c == nil {
+				c, err = NewClientFromConfig(cfg, "test")
+				require.NoErrorf(t, err, "Error creating HTTP Client: %v", err)
+			}
 
-	req, err := http.NewRequest(http.MethodGet, testServer.URL, nil)
-	require.NoErrorf(t, err, "Error creating HTTP request: %v", err)
+			req, err := http.NewRequest(http.MethodGet, testServer.URL, nil)
+			require.NoErrorf(t, err, "Error creating HTTP request: %v", err)
 
-	r, err := c.Do(req)
-	require.NoErrorf(t, err, "Can't connect to the test server")
-	r.Body.Close()
+			r, err := c.Do(req)
+			require.NoErrorf(t, err, "Can't connect to the test server")
+			r.Body.Close()
 
-	err = os.WriteFile(cert, []byte("-----BEGIN GARBAGE-----\nabc\n-----END GARBAGE-----\n"), 0o664)
-	require.NoError(t, err)
+			writeCertificate(bs, tc.cert, cert)
+			writeCertificate(bs, tc.key, key)
+
+			r, err = c.Do(req)
+			if len(tc.errMsg) > 0 {
+				if err == nil {
+					r.Body.Close()
+					t.Fatalf("Could connect to the test server.")
+				}
+				require.ErrorContainsf(t, err, tc.errMsg, "Expected error message to contain %q, got %q", tc.errMsg, err)
+				return
+			}
 
-	_, err = c.Do(req)
-	require.ErrorContainsf(t, err, "unable to use specified CA cert: none configured", "Expected error to mention missing CA cert")
+			require.NoErrorf(t, err, "Expected no error, got %q", err)
+
+			b, err := io.ReadAll(r.Body)
+			r.Body.Close()
+			if err != nil {
+				t.Errorf("Can't read the server response body")
+			}
+
+			got := strings.TrimSpace(string(b))
+			if ExpectedMessage != got {
+				t.Errorf("The expected message %q differs from the obtained message %q", ExpectedMessage, got)
+			}
+		})
+	}
 }
 
 // loadHTTPConfigJSON parses the JSON input s into a HTTPClientConfig.

config/testdata/client.crt

@@ -1,32 +1,32 @@
 -----BEGIN CERTIFICATE-----
-MIIFgjCCA2qgAwIBAgIRAMMSh5NoexSCjSvDRf1fpgQwDQYJKoZIhvcNAQELBQAw
+MIIFgjCCA2qgAwIBAgIRAOizkDX0s4ogKGqs7xBHWCwwDQYJKoZIhvcNAQELBQAw
 aTELMAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxKTAnBgNVBAsTIFBy
 b21ldGhldXMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRowGAYDVQQDExFQcm9tZXRo
-ZXVzIFRMUyBDQTAgFw0yMjA3MDgwOTE1MDhaGA8yMDcyMDYyNTA5MTUwOFowNjEL
+ZXVzIFRMUyBDQTAgFw0yNjA0MjQxODQ4MjNaGA8yMDc2MDQxMTE4NDgyM1owNjEL
 MAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxEjAQBgNVBAMTCWxvY2Fs
-aG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKE5sMf63irOiAEo
-a5GMONLHDji9ATAVs1erm6NW/17UPOSjN1Q1n6JGTp2XLKb5gle7gdGdjXW9IB6n
-PhXwQp4ZvTaucMxcZ+Zik19tn+azKdfj/FXU0c9R5oEv4B/1jfKG258dQF5es/Ga
-A2WW3nWA6IwQkHcBcN7cBQCZZ1GcM81rxybuyU4k/FyMheehcJ5MN8iy0Y0YrMcZ
-KxmRfAR/EfVYjenWXjZNncsUXotQr5I4wBUJ/pj5pYQWpSuyO6oADX1EzcxuL6bO
-XoEHfGFqmr90lM/x19bHzllu1UxIwqmT8jW3Je89EhlBxb0htNWNg4hKY7658Khq
-L0tx0AsdIru/JuoQGXrDs4yf+3xL51zSeMr6jewl6AyGQKCc5E+c/zwklCdsVFw7
-zapbT6Hok5HjSoMnRi/EGLtd33CQjvgGooPA4LLzWpbZhoA7QZLBXhvAG3qIkTXr
-1SaDQcP6GvYItEo3Yvqle7hWqhJB5E7QJ2+0j0ztbOLZBkuQGmiT4Ebsx5IJrRaT
-jDCkqYzuHjdTAtwDQR6Tuy2Sc+AuAxI4kDH6EwpX5X7E2mkE2RyYusiu6o400K6F
-QhRysPf1BXxSwQgcvsQTjcl8InyY/JT+7q7TCOLaXoj5rQDwIQdao0IRgr1+M7FQ
-5rsuLRD92EI/vLfSikk3MxcwZ1qzAgMBAAGjVjBUMA4GA1UdDwEB/wQEAwIFIDAT
-BgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFMaa
-Hh5g0+YopeLd1IkizXyK9K/zMA0GCSqGSIb3DQEBCwUAA4ICAQA1qIgzzSid9YZS
-v3kfqaDmZ3ickDuoJg4DjOz4AoZF+o2SnS/kXrIs/pTABUcfhgxt6xNJUFPIi2Pa
-IQXkS24Ya85RJxNUrJmqwhavONoxNoC9RBdNqwQy30DxrBcB+881Y/Ln3VQu6mfj
-aLFk09LFddz3Uc26spc257GkWfvdKjki5xDiFYze8KO0s+J/OWluNOiBG1Pehj+c
-CkwPzy9lwX0JCbAhsDkJGSY4rh+MO/bg9RemuqCPrmOIH8laBnJFvMTZyZRUTQlB
-pAcS8Oa6Bth5DUV7XSwWD6ZOe8Jo5BzJmw5hd5/EA+0+LwZqxmB9d7lGMKgEOMJw
-rIQZCN5PlYYkp31y190rw5XklHMeUJUNzcZKa/tNhjwmU5Pj01gdS5/AnFqO3zRW
-w3jUI6GR7rqj8g4P/kigIUyuX1Our6K27HUWVmt/SC+DHrhF+J7xet0q3R+UwUx1
-4wTzXnA1++s19G9wzo/HenCOTvU2bprl/WQ66/lICU+xxwHfs6kltY3SItvczqOf
-+iZrmDn/0jmoarkhaND0EpiG6FbsNWsCprPP1uj0ICqvcBD7VfqT4NWY8QWcoqqr
-JxiOAuuh0iNj8dmax3suNmd+XKIhVHZ3lRBRxrsqqi67axk3mgQby2j9sLxNmrqD
-Lc+UGxJB/WZg4NvzZSaj2MZmt4zOHQ==
+aG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAN1MI3XG/1/GfmQB
+vqIl7Ow82nM1ZtBHIJzLtYJp1vVoHnVvF/jR8PjafaMVX+6R6cnF8aQ4GOKrTwax
+BdNB4ij62KlaXh7e57JiMWydbOwCvtWfEUlFuUYOQbImEY2/jUJUKZPveLKpXGvH
+XOSIq4jJFNI4FjR1QoHj7EFSxktfn1wDzOfvczmUYKGjXsh0LYNGmkKix5UH82OY
+hlNdCqTV0QK3gmQJ6LAzzOe2b6o8Zao1FdVgnwWQtXnKXnFSvRBfrpY5rCppw8pI
+kHNTXApDbUvdr8N+gvSSmtPd/d9nqg2/x55uxgVOQA+9NSo3KN1tvUJgIdzqDHhN
+WgCo0jV3fKsdeyi05v0Rx71SKPxseRSPbJgmO11U7rg/nXwI3MOr9+nBQJGb1/8I
+aBqAl5AZKylJTB/c42fW6W3nADUatRpn/UjRZuReXeDwnvydxe7l9+SrP3GktHZH
+IROJGnxz8rwjlL5UYd5dzjQ9v7mU157sE76veE54OCSQo2S9v8SmyK8UN2PwIhvw
+H4cOK5eW1NVHLl0BdNvZFY/ysqKwOpAHp5iX1ZB0L+dq74I/F2weGqzoY9LEz8Oq
+L1wGeGsBLGTsOTt3O8PtTynfOAQ4SbTouzpGYRTvEV+YCwi2DZBsAxduK1MRSJES
+obni54L/vbjfmw6Rx8FHzDScv8RnAgMBAAGjVjBUMA4GA1UdDwEB/wQEAwIFIDAT
+BgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHD
+Wkn86+tlhyjbNhjW9TAus5STMA0GCSqGSIb3DQEBCwUAA4ICAQBmnvO8UY4toq0J
+l/AjwjBvsNutkUxXibwwJz3I4YTba8OwJ913H1L03YESz5te6U8dntdDw0yK/0o5
+fOwi5X/qheMsIE/K7haTTZQvgIhu18YxBQ10OT0ry9x5kYrCPrOqzM1hxf6lbFHR
+R9vvs7hkRFZ2lioiL8VAmyn3FDXjCrqyPPM/Sv7G1BXT9svA35gFNV04BdKUygMi
+T8f3wcbqDzL3hUjD8Z+O4tqQLIqtrIDu1B0uxFY7s5YvBX2R5UsU4bDgXGf9R6go
++9tI2RQJAtMxaMk/Ece/mk2gl1LWN9g4MrJw6jaUBi/sRJOZl1yx2LX/mloqGHx9
+KNDK9TJOP2nL5T19HGneT3tuuaKwa6rDiKyFmNHOEuFTb5pJSVepo6v7x5lFp8O4
+nqsTw0cWqaFG2NsJnKqlTkXcrUvK80QDzUHpWbjGsoPl0VFx7TITddTw+UAVR9Gj
+VZAXGcl6LYMuxATsq4DG4WOE7GA0KNEgTj9PEEF2HmVNuJCuPXuLIK/hAHLT3nuy
+avyfYBsx+GFZMgFVSqLA20ao1P46jZK0QA0BgSRHXLDpha8Md97HdluM5j9pwR8+
+jj3+jjlMSVqOzkJl0CV5gLj+yvrGrI1xJRizQRvjw6VMHUwqhyXHO0tCcfF2y8RN
+RBHWiRZNFFXE8R/QndeD3/iHLA9Wxw==
 -----END CERTIFICATE-----

config/testdata/client.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQChObDH+t4qzogB
-KGuRjDjSxw44vQEwFbNXq5ujVv9e1DzkozdUNZ+iRk6dlyym+YJXu4HRnY11vSAe
-pz4V8EKeGb02rnDMXGfmYpNfbZ/msynX4/xV1NHPUeaBL+Af9Y3yhtufHUBeXrPx
-mgNllt51gOiMEJB3AXDe3AUAmWdRnDPNa8cm7slOJPxcjIXnoXCeTDfIstGNGKzH
-GSsZkXwEfxH1WI3p1l42TZ3LFF6LUK+SOMAVCf6Y+aWEFqUrsjuqAA19RM3Mbi+m
-zl6BB3xhapq/dJTP8dfWx85ZbtVMSMKpk/I1tyXvPRIZQcW9IbTVjYOISmO+ufCo
-ai9LcdALHSK7vybqEBl6w7OMn/t8S+dc0njK+o3sJegMhkCgnORPnP88JJQnbFRc
-O82qW0+h6JOR40qDJ0YvxBi7Xd9wkI74BqKDwOCy81qW2YaAO0GSwV4bwBt6iJE1
-69Umg0HD+hr2CLRKN2L6pXu4VqoSQeRO0CdvtI9M7Wzi2QZLkBpok+BG7MeSCa0W
-k4wwpKmM7h43UwLcA0Eek7stknPgLgMSOJAx+hMKV+V+xNppBNkcmLrIruqONNCu
-hUIUcrD39QV8UsEIHL7EE43JfCJ8mPyU/u6u0wji2l6I+a0A8CEHWqNCEYK9fjOx
-UOa7Li0Q/dhCP7y30opJNzMXMGdaswIDAQABAoICAHKXAmLgl09tg5TvGaVVOH33
-JNCG5XU7t0A0pGYvy0mnJ7CJoSWlB1TbC71OWVpENLQOfXJyvLxWM6IV1DbbkT21
-pZpb2agmdWJ15bEJxYC/Dpp3XD3VCVqFJ4PidzW/3afm2en5bGqmfNbXVFq8JFj3
-ylDi5QrwZzy+vH90iM6kat0yIVY2mbWE7CkLZ5D+WYDpQyzOi8nxI7xO0ydVFARO
-HIF480SkLEoEWIaib6AtNNyEoWFSvTYVGeMMBVFNWMK3Tt8eK/eEyTGRs/GZVHoY
-vuwc/Dff+Dybvrop4Ehb3p+Qm7I5/ihQC7EP4m9Oqayu7DHOTZ6docLR1dOVjPt4
-F0qkeMGaGTDnfGmocqaKskGmhNWEnav5+aaYtFRXEqkLW53lIaGcWv2kyaFfvCYg
-L810FEn9D5OVmlLjgUrzeEctFmhO2Br33dLl90imtuVI3Kg/qzsM9fiV0KbsONzq
-I7aIvZZjXrevCOFtNSTfxNT8PrkyjWYN+2sbLWCR7hRvuzSTHI/qh2TzvyhqKeWc
-ZPVlIT2qvBN5OP+j42J54VXwJNIwUmbKfnETvHMp3Cht/UaEtj/vzAkYB0paEQUs
-O80vWwN4zk6H/qRV0HewUoNIGYlnTFLg/uOlLwbkctYH9ubEaobtVtwx6hsZ12AM
-m7N27FsiAf6KJOGN2CqhAoIBAQDBuQgDxtf3XaoUc8YJKnvGRFMmuq8VWIELF2E1
-/u+IWP8f89BoUon7J5VMHvKiuvsVa6bOJpENrp/fV9+5IA7a925U7il8LmGis+v7
-Sg5pWMJ6gUXq65jssXw0PPDyHEHL0WTwI6KlcI0+Pt8zPujq0TPeHBOadlaPHdg2
-lHEWPvuoAeZknLnYWF7Eq0y3cD2LBiFiZWNRO0wccFf7CA1O5ToUDkFB0zXB5ZOJ
-RgVSUQ5Gnva2OSB+dfFc3HwOADqjnBW+nMDi/ofH2rQEysEp4iTV4N+HkWxpNUPU
-9Z3KRUN645P1BK9ufwNnqsagJU8gKNR9EJKITiPU3jqKi/IvAoIBAQDVDjDi574a
-btsUQcUcip2na+D5jRts+/5lugA5OT6GzIRyYP8WgH7JMbwC91cB3avV08y5SHMB
-P1wo04qaBL+p1by19ewZ6f4Kfytoad7ZGb/P9tX8H30N8Q/k9kucn4igpJ6XaQXU
-tJIKWoBsNuUTZkPwa0+FMBBbRFRagu+mbOwnKR6zNIXNh18K7/LCJSb9jy73xG7k
-DEuRJH10Ow0Ijo4/UACm0CLdavtVtbkGfarETfZSUPuKMHs6dyAME94+IG3WgmWW
-B1WbtrWXw6RNhaecYDfjeW3iFOjgo+MpaQpnfiz7nqNrUu5zbteJYM2EdHI1baJ+
-/VXsXsc4hdK9AoIBAEyWkJqdpIiBmVpYozTAfQrXvGAVcl7oDKyL47zrO1wWg1bo
-l76G01JeReJAYgEAF4BSfTIHgVV9cmtkXGjeScE8DXy6Y+BanfMrWuKQVr5Dfy/b
-p/7GgkEhsk8cwM2XalPgRx3BmO37X3v6c1fZSVB8wRrQ0tdAbdxLGk4JxePbpra3
-eZTReZAU7/KlHsFvOIWcONqj5u4YmXCs4bu3ZTuJ2LpRIG+bxycPUpL1AemXbiNx
-eWx1jWkxy+jAqrMGWCiS7u3bH08e/iN/TaiPWGrso0+Dhhwc3FWD33t0V5u+Yn1V
-OAuofIsc4AW+OKTb2zqFqex//s6wxe3EpjRcO7UCggEAXVL5APtn3yY92pKwp77k
-LejoRAeWQtfi6GZgILC9fchqH7vzIMUqRDD/3QDA4PVbhq9e1q4wihRZ5xw6cxqv
-ZdJU9hOB1xwTBkAMIJF3ZvuLdKn3s5eLbKbyQmXMWw/ahht1yHbdcf2iltxrsnsd
-PrEmA1LOI1YZZBD7LiZ6mRjPHJw7cV4JWiz46c6PNJGXkau9dBRcSpJEK5CjT11q
-aRwgnQULNAaprvlknHecU4aKXbCUvBvzAuYXpFV3+TJewDHuSu8VVnFiA3I1+wNc
-ngR0ld/ju0V+Z3CnTXccUxBK2WiAhbtIdAOApZmg2fFINMPZHyQl8KBBmecuNskP
-tQKCAQALxoCzLhdq6Kl/mqqdPTlvncIuAoaH2VjEc5ZpMIHShPd1YfPv5/sQkD4B
-8X7QNLPITaSGvNTevyg/KtVPuWyyCxEjmIXDXOCXkylmJFY9tgaaSGPLRJ62sIbz
-EJGmUUOBYD+/ybV+dQd3GgkGJ0Hytp+FM8NCWukCFRAxb1m56xfs+RTBuLdJpou7
-AV+RafQV1roAQ+Pj3dFsoR6jBJIM4w0S5Q6609W062hrR6hBrlVBGfZpo/Mgmv5K
-HEnQ7X+AqPaK7BLdzBQb2Qd6hGF8DMVTSBRlc/THnhK/HlVCuWMNuEliGtmIuGYE
-0FRrwC2EvZmAS7m/FHfkpry76CRU
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDdTCN1xv9fxn5k
+Ab6iJezsPNpzNWbQRyCcy7WCadb1aB51bxf40fD42n2jFV/ukenJxfGkOBjiq08G
+sQXTQeIo+tipWl4e3ueyYjFsnWzsAr7VnxFJRblGDkGyJhGNv41CVCmT73iyqVxr
+x1zkiKuIyRTSOBY0dUKB4+xBUsZLX59cA8zn73M5lGCho17IdC2DRppCoseVB/Nj
+mIZTXQqk1dECt4JkCeiwM8zntm+qPGWqNRXVYJ8FkLV5yl5xUr0QX66WOawqacPK
+SJBzU1wKQ21L3a/DfoL0kprT3f3fZ6oNv8eebsYFTkAPvTUqNyjdbb1CYCHc6gx4
+TVoAqNI1d3yrHXsotOb9Ece9Uij8bHkUj2yYJjtdVO64P518CNzDq/fpwUCRm9f/
+CGgagJeQGSspSUwf3ONn1ult5wA1GrUaZ/1I0WbkXl3g8J78ncXu5ffkqz9xpLR2
+RyETiRp8c/K8I5S+VGHeXc40Pb+5lNee7BO+r3hOeDgkkKNkvb/EpsivFDdj8CIb
+8B+HDiuXltTVRy5dAXTb2RWP8rKisDqQB6eYl9WQdC/nau+CPxdsHhqs6GPSxM/D
+qi9cBnhrASxk7Dk7dzvD7U8p3zgEOEm06Ls6RmEU7xFfmAsItg2QbAMXbitTEUiR
+EqG54ueC/72435sOkcfBR8w0nL/EZwIDAQABAoICAAkwt/yuFEpd29jhlt4ObvQl
+Cm0KoWe/IUEYJERNJFke7Yjl+xv69NcSewsMGhnpY5Xc5RsM6cFCgqH3m+AF1lOD
+9P4cTr7y3ExBtkvy9VePcG2k6s32s2n2SwJctCtSJbBeZQQL4W2i1llzHZrJSQpn
+6dGMwVgekiUDAK6taXPIffDcOlgotX0FYJMsTdIYVRC+T8cg3uLQqJ1EJwWMqyKX
+7waxKINo3L0YlNPL27Mfr/8tSWgjpTPREMa4KBgft59XwenjBxETdGCdukLRcIfM
+L6lQN+DwC5Zs0jlzRWK2RoJf3dvo1zHYNpV3JgXIGNsQfotXoubIR4oYq3pOIiPa
+re8oA5+O4BjF2QphZcmFfcwBG8WgJe/K0chdV9u53FUVOQL/KWDIFYYQ5Gak7Xfd
+Y6fj8PVNI1ONkdw12DmsOELCLCtJj4WNFOIcLtdTyPn3LKjYyCiqAH7/nBqXwKgY
+TZ3g9v8FqZlNYjFjQTzxwsoPB0BtykYDEtJpAcZHhIGk3OWJhhwlcZlgz+adbM66
+/DRPmn7qAEFtvHqKd4d8JjV9ij9I3maQZNZAhijht0WODw30+k7mAFWL3ATyNSew
+ZZ2XtYImfqtRnGz+CaF46xulgPjL7RqMa2nhWqvqdNNCn242MJ228mUrSgJMDSnR
+IvEa6C2vphHh/vNyZJO5AoIBAQDdqXOK25bcfQEwOJAdpu2zB38qtnXiBxn//iI9
+FMrihiY076IeprNAgeFktN8zGQ+Q/WWhpr9xKizgsnApwx0tCpCvNnYAv+bZ0WRd
+fNqx6tNQTVO+xXYpVcQ4qHrKnq9p/g9/djLQPAGh40KcBNJ5tSJS0kk7vcwgNAU+
+Mot42Jr0NOWZg/7dfmiShVQa/aAUx/U3MozyaCChVpT2bhjKNgm7XwZsJ2dNHjbR
+rKfvpW1B9OutdNfFNMKEoUtSLDn0CuS7EZeuQkVvC+WEnvIfz/hn6PHn+NIn+T9r
+pT4QxY7+IIt0N/Lyv0k+GVs2DoF9Il240F1S0M3xvBL1R5YpAoIBAQD/lDteQNYT
+Zw3cZ1I5HE2HjZqmmhd52XbVSRP7AdCB17wpHU8/PVklEF3ODtUHoq2GOGxNfGte
+nllhenFRe0Fd0ZywuP3ACABi4cLb05x31+VFL+lOlFCDyrtDq6k1Xo22fKD18YeW
+o01teR3VvgG78aiusNQZfP6U7OkAFZWt377Io8IaaIRyH611KoLQF+7a85Li616d
+XReo2eImS8klTRGHWVIPAM6j6dBgHCDRs8+vwp2DVXqIL28tZxY0RiTY0wTefu4j
+ZqOEQnBge91OHoCnBsISXFPAziX9QoW3d+h/xpup2PkD9EycIK4+SQOgY8g8hVpS
+1+rkllSjrTgPAoIBAFkKdqVy7DkJ5e5O6mVe5uEhw82Ome//1kvk9DABKDaymKpv
+EHqrkBn7kmT32ykVihE+GRNEfmahAIIKa8/61r9/HPulLuXCMKOS33RGcTtDDzuU
+tG1PuNWF5Fq2Iw09jU1Qhz02Z9cKI8W6Gsm9jibhwjXuzwg2h8bv3qNLfoc+y5AJ
+p6lxQnILE0q4UD6/Xwy5/iD8J25Ascrdkt0jAMZJysL/uv67HV33IyI67wLvOuJh
+1kJJS1umg/TvLeiGZ4lGzvbubDXN3UJsTvhlOPHagviKtJHwe8se7oD5UeM+2N/w
+htRanTcx6+QMH32peg6gPXG+EZ7wzamrWRo6dXECggEBAKPHTMgYilbCqlo8B6+7
+WF9uOdVbV4Ho/kKtYtVuEzyxj81VD+x5lr+unj4muRL8h3BEhfqdqXxnwuU5fpZ1
+gqzpXxzMXyeIuR6kh6cxEsqlmjFdA4gsePALoTc7MOKXZf60HL2eeoHowfxOKfVH
+nnre4HaZsEFpHQc4ThOUwWc7w1l1vzQHGCC99fzoMg3B2HmMruslY2s6Nagpf8eE
+tzBlE7+FWJVusfzOH48HV2yqaoO6FhAMXcoZg4g30D3NWV1s1Gj0NAyRgGWH4dWi
+am3eFBl0tjbn3W/naubBk0i/2UjQb/5GoUSMb+947c/SIDXO24kU942w+cBkKXb9
+0LcCggEBAKNdXq8g07Of9K+AZu5J1pb6+9HKZ9aGsrI03/klcW8euz0pYgOF2ia3
+5PB+9EqQDq6ow7L7j3sn+EtaWvqYnYoup6gzOI1Rgs5gCpPXn51MP2UTQLStPY/1
+Q7pgGvYNGw53ngTbK/7jkws1pmo755Rr9OLdRj9/YhYOYngYbqEhLfWYjY/37mKD
+HqSd7AJR+OSRG2dg+Y/+hgFTjaQp6U5qrlh9gTWHHr8I9bwmK+wQ4Eq7lNP2N1qR
+Wl3T2xOZx6Jt1eVQ1g3MhsBbEh7ahJjO65kHNHUadWBvM7nlrdzxXd0tEKQEsUGq
+675ncMYLgYHoAK8pQHMwM7A2QkQDqcU=
 -----END PRIVATE KEY-----

config/testdata/client2.crt

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgIRAOizkDX0s4ogKGqs7xBHWC0wDQYJKoZIhvcNAQELBQAw
+aTELMAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxKTAnBgNVBAsTIFBy
+b21ldGhldXMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRowGAYDVQQDExFQcm9tZXRo
+ZXVzIFRMUyBDQTAgFw0yNjA0MjQxODQ4MjNaGA8yMDc2MDQxMTE4NDgyM1owNjEL
+MAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxEjAQBgNVBAMTCWxvY2Fs
+aG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMTgPSLZmWX8gZ0i
+keWuvTHMQhOt3v0U6JuTOseGeLzeGMIpRF/Tu91ar1ilsQ8QmUfCDHTnoY36SBAp
+DMSpurb9Paq9cvgeM0azJUM3HVZKIFU39rFoGNwMOgPrqOp89WwDs8jfPgmIZoYN
+apEhd4gGJQkCvD9QGtrSOXSR6/NWIMQUVVx0ufWTM1gn+ZocR1xnJ6oHbgwax0+Z
+YZrdEa5P0R9mEnvNNpf96UPvE8D4pYsopL1HEF1KlzqNKnPVz60fMTgGflZ7MWa7
+RohpfY7I1AEv2JmwKEtbIjUjeQ6Laezpt8xOE5iHwNr4RgzkMyz+c065wdzep4+E
+mq847ZUfcApSNp5PBxMCpfwccm5E2kpkaRbMSQ4sMj0CoQg5//Tf3n54Smk6hqOk
+7wNLOY3HHY1e7QThimi0hv5TSg6sK/YdaGMjQ4vMTVd5iCVyGN6Ju7jpoT6ot+Tv
+AKoADJqhnZdFdVy+jzyq1PKATQ0+klG4s3TsQliWD//P3yQJ75rm7tux3F5siaSw
+8gAnMD0SvEWDlbdLZTwNefpmVB/o6r4TYM1L4pHGzDGnuVF2pxk9Ur2iC4+0IfQd
+8eMkT2wOw2Nzs3CohCHlLcfoUVlKLulYS4uWHyt3/oIIFUnKxPzUcEEIDNH59Qgk
+EX5bq7zdGM5+Ora+u2BLS27BzNr3AgMBAAGjVjBUMA4GA1UdDwEB/wQEAwIFIDAT
+BgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHD
+Wkn86+tlhyjbNhjW9TAus5STMA0GCSqGSIb3DQEBCwUAA4ICAQBSbcvsqapAKLxo
+07iajdi6g8jT+RZF34PBwB+NtTbbfIUliWR6PR/rGBTY9H6fAqF3J4YfYOC1q0l+
+p4PidXC4q9yY4o6++PkGNYm2fsDY8PsqdnVELjs5vDMedGqDEFFUGMCLHblnBsR9
+DCZ/GTFKjFb1deM85CdkK/myMKfCNW1QVi9u/VX04NirTJv7k5+i6TY7iAjA6Y9l
+6GdwByEIsxL8oehNZ05HMVi4iRIUzqlV3aOBu5VFrZdQwqKmKQVfEkBPfQ1hu95n
+7fE6qdGB66T0oNAiaMipIE6fy/DlI7I4f832bOcH9zFNK6HvrXklVx+mrX2hCHWv
+LAQoWqPsOTFm4AVDHTzAOUTJzWD3e/V3uqJGCWOgQ/uQrR8YEgrrY0cpwvvq7uih
+DPlobkynO1WjlnwF7A4VI5Tr7sr0fgGbq4zG+zqJFcXEU7Ba4esW2B3jjNFbf02L
+XA4xgl1oszQaa9sjJ8T4dB/Gj4H5MuSpwVBte3FR4sY56e6I01EJAQ14XwR9T+HM
+nlbSprmpVdzBTjEOQD6zwwb8gJkPlxJpISGExX2DFo4JUcfmN8Xrb4u4qd6dq+8U
+SLecjOSwzkDRV6LN2/li+kefs8sm2ItxiTiJpqmTZoFEGW7lXuI0dZBHwGe4tqwq
+8EzR3AFd9zVFZdPv9NlznzlwlAZpdA==
+-----END CERTIFICATE-----