29 lines
856 B
Go
29 lines
856 B
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"time"
|
|
)
|
|
|
|
// brokerClient builds an HTTPS client that presents the host's TPM-backed mTLS
|
|
// identity to the enrol-broker's host plane and verifies the broker's server cert
|
|
// against the fleet CA. serverName for hostname verification is taken from the
|
|
// broker URL's host.
|
|
func brokerClient(id *tpmIdentity, brokerURL, caFile string) (*http.Client, error) {
|
|
u, err := url.Parse(brokerURL)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parse broker URL %q: %w", brokerURL, err)
|
|
}
|
|
if u.Scheme != "https" {
|
|
return nil, fmt.Errorf("broker URL must be https (mTLS), got %q", u.Scheme)
|
|
}
|
|
tlsCfg, err := mtlsClientConfig(id, caFile, u.Hostname())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
tr := &http.Transport{TLSClientConfig: tlsCfg}
|
|
return &http.Client{Timeout: 30 * time.Second, Transport: tr}, nil
|
|
}
|