log-backup: support CA-bundle certifications
ref tikv/tikv#13867, ref pingcap/tidb#38775
@@ -7,7 +7,10 @@ use std::{
use etcd_client::{ConnectOptions, Error as EtcdError, OpenSslClientConfig};
use futures::Future;
-use openssl::x509::verify::X509VerifyFlags;
+use openssl::{
+ pkey::PKey,
+ x509::{verify::X509VerifyFlags, X509},
+};
use security::SecurityManager;
use tikv_util::{
info,
@@ -59,7 +62,20 @@ impl ConnectionConfig {
// We haven't make it configurable because it is enabled in gRPC by default too.
// TODO: Perhaps implement grpc-io based etcd client, fully remove the difference between gRPC TLS and our custom TLS?
.manually(|c| c.cert_store_mut().set_flags(X509VerifyFlags::PARTIAL_CHAIN))
- .client_cert_pem_and_key(&tls.client_cert, &tls.client_key.0),
+ .manually(|c| {
+ let mut client_certs= X509::stack_from_pem(&tls.client_cert)?;
+ let client_key = PKey::private_key_from_pem(&tls.client_key.0)?;
+ if !client_certs.is_empty() {
+ c.set_certificate(&client_certs[0])?;
+ }
+ if client_certs.len() > 1 {
+ for i in client_certs.drain(1..) {
+ c.add_extra_chain_cert(i)?;
+ }
+ }
+ c.set_private_key(&client_key)?;
+ Ok(())
+ }),
)
}
opts = opts
