a0d26a7ba7
This adds an alternative method for TLS clients to authenticate to the server by presenting a client certificate in the TLS handshake. In order for dcrd to trust this client, the certificate authority must be added as a trusted root (by default, in clients.pem in dcrd's application data directory) as well as setting the config value authtype=clientcerts. HTTP POST and websocket clients need not provide HTTP Basic authentication when client certificates are used. In future changes, TLS client authentication may be used to limit access to particular RPCs by various clients, which is possible now that each client can present their own cryptographic identity. However, at the moment, enabling TLS client authentication requires it at the TLS listener level, and therefore breaks the --rpclimituser/rpclimitpass mechanism to provide non-admin client authentication. Additional changes will be required to provide the client identity through the request context in order to bring back limited access for clients. Users depending on the limited user settings should avoid using client certificates in the meantime. |
||
|---|---|---|
| .. | ||
| testdata | ||
| doc.go | ||
| interface.go | ||
| log.go | ||
| README.md | ||
| rpcserver_test.go | ||
| rpcserver.go | ||
| rpcserverhandlers_test.go | ||
| rpcserverhelp_test.go | ||
| rpcserverhelp.go | ||
| rpcwebsocket.go | ||
| treasury_test.go | ||
