adding ssh host signing

files/ssh-hostcert/http.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// brokerClient builds an HTTPS client that presents the host's TPM-backed mTLS
+// identity to the enrol-broker's host plane and verifies the broker's server cert
+// against the fleet CA. serverName for hostname verification is taken from the
+// broker URL's host.
+func brokerClient(id *tpmIdentity, brokerURL, caFile string) (*http.Client, error) {
+	u, err := url.Parse(brokerURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse broker URL %q: %w", brokerURL, err)
+	}
+	if u.Scheme != "https" {
+		return nil, fmt.Errorf("broker URL must be https (mTLS), got %q", u.Scheme)
+	}
+	tlsCfg, err := mtlsClientConfig(id, caFile, u.Hostname())
+	if err != nil {
+		return nil, err
+	}
+	tr := &http.Transport{TLSClientConfig: tlsCfg}
+	return &http.Client{Timeout: 30 * time.Second, Transport: tr}, nil
+}