multiple client CAs

src/main/kotlin/io/emeraldpay/dshackle/TlsSetup.kt

@@ -26,6 +26,7 @@ import org.apache.commons.lang3.StringUtils
 import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.stereotype.Service
+import java.security.cert.CertificateFactory
 
 @Service
 open class TlsSetup(
@@ -77,10 +78,18 @@ open class TlsSetup(
                     fileResolver.resolve(config.key!!)
                 )
             }
-            if (StringUtils.isNotEmpty(config.clientCa)) {
+            if (config.clientCAs.isNotEmpty()) {
                 log.info("Using TLS for client authentication for $category")
+                val cf = CertificateFactory.getInstance("X.509")
                 sslContextBuilder.trustManager(
-                    fileResolver.resolve(config.clientCa!!)
+
+                    config.clientCAs
+                        .map { fileResolver.resolve(it) }
+                        .map { file ->
+                            file.inputStream().use {
+                                cf.generateCertificate(it) as java.security.cert.X509Certificate
+                            }
+                        }
                 )
                 if (config.clientRequire != null && config.clientRequire!!) {
                     sslContextBuilder.clientAuth(ClientAuth.REQUIRE)

src/main/kotlin/io/emeraldpay/dshackle/config/AuthConfig.kt

@@ -56,6 +56,6 @@ class AuthConfig {
         var certificate: String? = null
         var key: String? = null
         var clientRequire: Boolean? = null
-        var clientCa: String? = null
+        var clientCAs: MutableList<String> = mutableListOf()
     }
 }

src/main/kotlin/io/emeraldpay/dshackle/config/AuthConfigReader.kt

@@ -18,6 +18,7 @@ package io.emeraldpay.dshackle.config
 
 import org.slf4j.LoggerFactory
 import org.yaml.snakeyaml.nodes.MappingNode
+import org.yaml.snakeyaml.nodes.ScalarNode
 
 class AuthConfigReader : YamlConfigReader<AuthConfig>() {
 
@@ -77,7 +78,15 @@ class AuthConfigReader : YamlConfigReader<AuthConfig>() {
                 getValueAsBool(clientNode, "require")?.let {
                     auth.clientRequire = it
                 }
-                auth.clientCa = getValueAsString(clientNode, "ca")
+                getValueAsString(clientNode, "ca")?.let {
+                    auth.clientCAs.add(it)
+                }
+                getList<ScalarNode>(clientNode, "cas")?.let {
+                    println(it)
+                    it.value?.let { crt ->
+                        auth.clientCAs.addAll(crt.map { v -> v.value })
+                    }
+                }
             }
             auth
         }

src/test/groovy/io/emeraldpay/dshackle/TlsSetupSpec.groovy

@@ -78,7 +78,7 @@ class TlsSetupSpec extends Specification {
                 certificate: "127.0.0.1.crt",
                 key: "127.0.0.1.p8.key",
                 clientRequire: true,
-                clientCa: "ca.myhost.dev.crt"
+                clientCAs: ["ca.myhost.dev.crt"]
         )
         when:
         def act = tlsSetup.setupServer("test", config, false)
@@ -182,12 +182,12 @@ class TlsSetupSpec extends Specification {
                 certificate: "127.0.0.1.crt",
                 key: "127.0.0.1.p8.key",
                 clientRequire: true,
-                clientCa: "none.crt"
+                clientCAs: ["none.crt"]
         )
         when:
         tlsSetup.setupServer("test", config, false)
         then:
-        def t = thrown(IllegalArgumentException)
+        def t = thrown(FileNotFoundException)
     }
 
     def "Fail if client certificate is invalid"() {
@@ -197,11 +197,11 @@ class TlsSetupSpec extends Specification {
                 certificate: "127.0.0.1.crt",
                 key: "127.0.0.1.p8.key",
                 clientRequire: true,
-                clientCa: "ca.myhost.dev.key"
+                clientCAs: ["ca.myhost.dev.key"]
         )
         when:
         tlsSetup.setupServer("test", config, false)
         then:
-        def t = thrown(IllegalArgumentException)
+        def t = thrown(java.security.cert.CertificateParsingException)
     }
 }

src/test/groovy/io/emeraldpay/dshackle/config/AuthConfigReaderSpec.groovy

@@ -72,6 +72,6 @@ class AuthConfigReaderSpec extends Specification {
         act.key == "/etc/client1.myservice.com.key"
         act.clientRequire != null
         !act.clientRequire
-        act.clientCa == "/etc/ca.myservice.com.crt"
+        act.clientCAs == ["/etc/ca.myservice.com.crt"]
     }
 }

src/test/groovy/io/emeraldpay/dshackle/config/MainConfigReaderSpec.groovy

@@ -39,7 +39,7 @@ class MainConfigReaderSpec extends Specification {
             certificate == "/path/127.0.0.1.crt"
             key == "/path/127.0.0.1.p8.key"
             !clientRequire
-            clientCa == "/path/ca.dshackle.test.crt"
+            clientCAs == ["/path/ca.dshackle.test.crt"]
         }
         act.cache != null
         with(act.cache) {