multiple client CAs

src/main/kotlin/io/emeraldpay/dshackle/TlsSetup.kt

@@ -26,6 +26,7 @@ import org.apache.commons.lang3.StringUtils
 import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.stereotype.Service
+import java.security.cert.CertificateFactory
 
 @Service
 open class TlsSetup(
@@ -77,10 +78,18 @@ open class TlsSetup(
                     fileResolver.resolve(config.key!!)
                 )
             }
-            if (StringUtils.isNotEmpty(config.clientCa)) {
+            if (config.clientCAs.isNotEmpty()) {
                 log.info("Using TLS for client authentication for $category")
+                val cf = CertificateFactory.getInstance("X.509")
                 sslContextBuilder.trustManager(
-                    fileResolver.resolve(config.clientCa!!)
+
+                    config.clientCAs
+                        .map { fileResolver.resolve(it) }
+                        .map { file ->
+                            file.inputStream().use {
+                                cf.generateCertificate(it) as java.security.cert.X509Certificate
+                            }
+                        }
                 )
                 if (config.clientRequire != null && config.clientRequire!!) {
                     sslContextBuilder.clientAuth(ClientAuth.REQUIRE)

src/main/kotlin/io/emeraldpay/dshackle/config/AuthConfig.kt

@@ -56,6 +56,6 @@ class AuthConfig {
         var certificate: String? = null
         var key: String? = null
         var clientRequire: Boolean? = null
-        var clientCa: String? = null
+        var clientCAs: MutableList<String> = mutableListOf()
     }
 }

src/main/kotlin/io/emeraldpay/dshackle/config/AuthConfigReader.kt

@@ -18,6 +18,7 @@ package io.emeraldpay.dshackle.config
 
 import org.slf4j.LoggerFactory
 import org.yaml.snakeyaml.nodes.MappingNode
+import org.yaml.snakeyaml.nodes.ScalarNode
 
 class AuthConfigReader : YamlConfigReader<AuthConfig>() {
 
@@ -77,7 +78,15 @@ class AuthConfigReader : YamlConfigReader<AuthConfig>() {
                 getValueAsBool(clientNode, "require")?.let {
                     auth.clientRequire = it
                 }
-                auth.clientCa = getValueAsString(clientNode, "ca")
+                getValueAsString(clientNode, "ca")?.let {
+                    auth.clientCAs.add(it)
+                }
+                getList<ScalarNode>(clientNode, "cas")?.let {
+                    println(it)
+                    it.value?.let { crt ->
+                        auth.clientCAs.addAll(crt.map { v -> v.value })
+                    }
+                }
             }
             auth
         }