Replace global loggers with local loggers in tlscommon package (#334)

khushijain21 · web-flow · commit a9550f16914c · 2025-08-04T12:23:11.000+05:30
* Add event tag for logs from tls
diff --git a/transport/httpcommon/httpcommon.go b/transport/httpcommon/httpcommon.go
@@ -185,7 +185,8 @@ func (settings *HTTPTransportSettings) Unpack(cfg *config.C) error {
 		return err
 	}
 
-	_, err := tlscommon.LoadTLSConfig(tmp.TLS)
+	// TODO: use local logger here
+	_, err := tlscommon.LoadTLSConfig(tmp.TLS, logp.NewLogger(""))
 	if err != nil {
 		return err
 	}
@@ -213,6 +214,11 @@ func (settings *HTTPTransportSettings) RoundTripper(opts ...TransportOption) (ht
 		}
 	}
 
+	logger := logp.NewLogger("")
+	if log := extra.logger; log != nil {
+		logger = log
+	}
+
 	for _, opt := range opts {
 		if dialOpt, ok := opt.(dialerOption); ok {
 			dialer = dialOpt.baseDialer()
@@ -223,7 +229,7 @@ func (settings *HTTPTransportSettings) RoundTripper(opts ...TransportOption) (ht
 		dialer = transport.NetDialer(settings.Timeout)
 	}
 
-	tls, err := tlscommon.LoadTLSConfig(settings.TLS)
+	tls, err := tlscommon.LoadTLSConfig(settings.TLS, logger)
 	if err != nil {
 		return nil, err
 	}
diff --git a/transport/tlscommon/ca_pinning_test.go b/transport/tlscommon/ca_pinning_test.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/elastic/elastic-agent-libs/config"
 	"github.com/elastic/elastic-agent-libs/iobuf"
+	"github.com/elastic/elastic-agent-libs/logp/logptest"
 	"github.com/elastic/elastic-agent-libs/transport/tlscommontest"
 )
 
@@ -51,7 +52,7 @@ func TestCAPinning(t *testing.T) {
 		err := cfg.Unpack(config)
 		require.NoError(t, err)
 
-		tlsCfg, err := LoadTLSConfig(config)
+		tlsCfg, err := LoadTLSConfig(config, logptest.NewTestingLogger(t, ""))
 		require.NoError(t, err)
 
 		tls := tlsCfg.BuildModuleClientConfig(host)
@@ -67,7 +68,7 @@ func TestCAPinning(t *testing.T) {
 		err := cfg.Unpack(config)
 		require.NoError(t, err)
 
-		tlsCfg, err := LoadTLSConfig(config)
+		tlsCfg, err := LoadTLSConfig(config, logptest.NewTestingLogger(t, ""))
 		require.NoError(t, err)
 
 		tls := tlsCfg.BuildModuleClientConfig(host)
diff --git a/transport/tlscommon/config.go b/transport/tlscommon/config.go
@@ -20,6 +20,8 @@ package tlscommon
 import (
 	"crypto/tls"
 	"errors"
+
+	"github.com/elastic/elastic-agent-libs/logp"
 )
 
 // Config defines the user configurable options in the yaml file.
@@ -40,7 +42,7 @@ type Config struct {
 // defined. If Certificate and CertificateKey are configured, client authentication
 // will be configured. If no CAs are configured, the host CA will be used by go
 // built-in TLS support.
-func LoadTLSConfig(config *Config) (*TLSConfig, error) {
+func LoadTLSConfig(config *Config, logger *logp.Logger) (*TLSConfig, error) {
 	if !config.IsEnabled() {
 		return nil, nil
 	}
@@ -86,6 +88,7 @@ func LoadTLSConfig(config *Config) (*TLSConfig, error) {
 		Renegotiation:        tls.RenegotiationSupport(config.Renegotiation),
 		CASha256:             config.CASha256,
 		CATrustedFingerprint: config.CATrustedFingerprint,
+		logger:               logger,
 	}, nil
 }
 
diff --git a/transport/tlscommon/server_config.go b/transport/tlscommon/server_config.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 
 	"github.com/elastic/elastic-agent-libs/config"
+	"github.com/elastic/elastic-agent-libs/logp"
 )
 
 // ServerConfig defines the user configurable tls options for any TCP based service.
@@ -40,7 +41,7 @@ type ServerConfig struct {
 
 // LoadTLSServerConfig tranforms a ServerConfig into a `tls.Config` to be used directly with golang
 // network types.
-func LoadTLSServerConfig(config *ServerConfig) (*TLSConfig, error) {
+func LoadTLSServerConfig(config *ServerConfig, logger *logp.Logger) (*TLSConfig, error) {
 	if !config.IsEnabled() {
 		return nil, nil
 	}
@@ -95,6 +96,7 @@ func LoadTLSServerConfig(config *ServerConfig) (*TLSConfig, error) {
 		CurvePreferences: curves,
 		ClientAuth:       tls.ClientAuthType(clientAuth),
 		CASha256:         config.CASha256,
+		logger:           logger,
 	}, nil
 }
 
diff --git a/transport/tlscommon/tls_config.go b/transport/tlscommon/tls_config.go
@@ -86,6 +86,8 @@ type TLSConfig struct {
 	// time returns the current time as the number of seconds since the epoch.
 	// If time is nil, TLS uses time.Now.
 	time func() time.Time
+
+	logger *logp.Logger
 }
 
 var (
@@ -104,7 +106,7 @@ func (c *TLSConfig) ToConfig() *tls.Config {
 
 	insecure := c.Verification != VerifyStrict
 	if c.Verification == VerifyNone {
-		logp.NewLogger("tls").Warn("SSL/TLS verifications disabled.")
+		c.logger.Named("tls").Warn("SSL/TLS verifications disabled.")
 	}
 
 	return &tls.Config{
@@ -119,7 +121,7 @@ func (c *TLSConfig) ToConfig() *tls.Config {
 		Renegotiation:      c.Renegotiation,
 		ClientAuth:         c.ClientAuth,
 		Time:               c.time,
-		VerifyConnection:   makeVerifyConnection(c),
+		VerifyConnection:   makeVerifyConnection(c, c.logger),
 	}
 }
 
@@ -133,7 +135,7 @@ func (c *TLSConfig) BuildModuleClientConfig(host string) *tls.Config {
 			VerifyConnection: makeVerifyConnection(&TLSConfig{
 				Verification: VerifyFull,
 				ServerName:   host,
-			}),
+			}, logp.NewLogger("tls")),
 		}
 	}
 
@@ -175,8 +177,8 @@ func (c *TLSConfig) BuildServerConfig(host string) *tls.Config {
 	return config
 }
 
-func trustRootCA(cfg *TLSConfig, peerCerts []*x509.Certificate) error {
-	logger := logp.NewLogger("tls")
+func trustRootCA(cfg *TLSConfig, peerCerts []*x509.Certificate, logger *logp.Logger) error {
+	logger = logger.Named("tls")
 	logger.Info("'ca_trusted_fingerprint' set, looking for matching fingerprints")
 	fingerprint, err := hex.DecodeString(cfg.CATrustedFingerprint)
 	if err != nil {
@@ -223,7 +225,7 @@ func trustRootCA(cfg *TLSConfig, peerCerts []*x509.Certificate) error {
 	return nil
 }
 
-func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {
+func makeVerifyConnection(cfg *TLSConfig, logger *logp.Logger) func(tls.ConnectionState) error {
 	serverName := cfg.ServerName
 
 	switch cfg.Verification {
@@ -233,7 +235,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {
 		// tls.Config.InsecureSkipVerify  is set to true
 		return func(cs tls.ConnectionState) error {
 			if cfg.CATrustedFingerprint != "" {
-				if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {
+				if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {
 					return err
 				}
 			}
@@ -259,7 +261,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {
 		// tls.Config.InsecureSkipVerify is set to true
 		return func(cs tls.ConnectionState) error {
 			if cfg.CATrustedFingerprint != "" {
-				if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {
+				if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {
 					return err
 				}
 			}
@@ -284,7 +286,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {
 		if len(cfg.CASha256) > 0 {
 			return func(cs tls.ConnectionState) error {
 				if cfg.CATrustedFingerprint != "" {
-					if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {
+					if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {
 						return err
 					}
 				}
diff --git a/transport/tlscommon/tls_config_test.go b/transport/tlscommon/tls_config_test.go
@@ -30,8 +30,12 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"go.uber.org/zap/zaptest/observer"
 
 	"github.com/elastic/elastic-agent-libs/logp"
+	"github.com/elastic/elastic-agent-libs/logp/logptest"
 	"github.com/elastic/elastic-agent-libs/transport/tlscommontest"
 )
 
@@ -262,9 +266,12 @@ func TestTrustRootCA(t *testing.T) {
 			}
 
 			// Capture the logs
-			_ = logp.DevelopmentSetup(logp.ToObserverOutput())
+			observedCore, observedLogs := observer.New(zapcore.DebugLevel)
+			logger := logptest.NewTestingLogger(t, "test", zap.WrapCore(func(core zapcore.Core) zapcore.Core {
+				return observedCore
+			}))
 
-			err := trustRootCA(&cfg, tc.peerCerts)
+			err := trustRootCA(&cfg, tc.peerCerts, logger)
 			if tc.expectingError && err == nil {
 				t.Fatal("expecting an error when calling trustRootCA")
 			}
@@ -274,7 +281,7 @@ func TestTrustRootCA(t *testing.T) {
 			}
 
 			if len(tc.expectingWarnings) > 0 {
-				warnings := logp.ObserverLogs().FilterLevelExact(logp.WarnLevel.ZapLevel()).TakeAll()
+				warnings := observedLogs.FilterLevelExact(logp.WarnLevel.ZapLevel()).TakeAll()
 				if len(warnings) == 0 {
 					t.Fatal("expecting a warning message")
 				}
@@ -385,7 +392,7 @@ func TestMakeVerifyConnectionUsesCATrustedFingerprint(t *testing.T) {
 				CASha256:             test.CASHA256,
 			}
 
-			verifier := makeVerifyConnection(cfg)
+			verifier := makeVerifyConnection(cfg, logptest.NewTestingLogger(t, ""))
 			if test.expectedCallback {
 				require.NotNil(t, verifier, "makeVerifyConnection returned a nil verifier")
 			} else {
@@ -469,7 +476,7 @@ func TestMakeVerifyServerConnectionForIPs(t *testing.T) {
 				Verification: test.verificationMode,
 				ServerName:   test.serverName,
 			}
-			verifier := makeVerifyConnection(cfg)
+			verifier := makeVerifyConnection(cfg, logptest.NewTestingLogger(t, ""))
 
 			err = verifier(tls.ConnectionState{
 				PeerCertificates: []*x509.Certificate{peerCerts.Leaf},
@@ -644,6 +651,7 @@ func TestVerificationMode(t *testing.T) {
 				Verification: test.verificationMode,
 				RootCAs:      certPool,
 				ServerName:   test.hostname,
+				logger:       logptest.NewTestingLogger(t, ""),
 			}
 
 			if test.ignoreCerts {
diff --git a/transport/tlscommon/tls_fips_test.go b/transport/tlscommon/tls_fips_test.go
@@ -26,6 +26,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/elastic/elastic-agent-libs/logp/logptest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -53,7 +54,7 @@ func TestFIPSCertificateAndKeys(t *testing.T) {
 		cfg.Certificate.Key = string(rawKey)
 		cfg.Certificate.Passphrase = password
 
-		_, err = LoadTLSConfig(cfg)
+		_, err = LoadTLSConfig(cfg, logptest.NewTestingLogger(t, ""))
 		require.Error(t, err)
 		assert.ErrorIs(t, err, errors.ErrUnsupported, err)
 	})
@@ -68,7 +69,7 @@ func TestFIPSCertificateAndKeys(t *testing.T) {
 		cfg.Certificate.Key = key
 		cfg.Certificate.Passphrase = password
 
-		_, err = LoadTLSConfig(cfg)
+		_, err = LoadTLSConfig(cfg, logptest.NewTestingLogger(t, ""))
 		assert.ErrorIs(t, err, errors.ErrUnsupported)
 	})
 }
diff --git a/transport/tlscommon/tls_nofips_test.go b/transport/tlscommon/tls_nofips_test.go
@@ -26,6 +26,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/elastic/elastic-agent-libs/logp/logptest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -52,7 +53,7 @@ func TestNoFIPSCertificateAndKeys(t *testing.T) {
 		cfg.Certificate.Key = string(rawKey)
 		cfg.Certificate.Passphrase = password
 
-		tlsC, err := LoadTLSConfig(cfg)
+		tlsC, err := LoadTLSConfig(cfg, logptest.NewTestingLogger(t, ""))
 		require.NoError(t, err)
 		assert.NotNil(t, tlsC)
 	})
@@ -67,20 +68,21 @@ func TestNoFIPSCertificateAndKeys(t *testing.T) {
 		cfg.Certificate.Key = key
 		cfg.Certificate.Passphrase = password
 
-		tlsC, err := LoadTLSConfig(cfg)
+		tlsC, err := LoadTLSConfig(cfg, logptest.NewTestingLogger(t, ""))
 		require.NoError(t, err)
 		assert.NotNil(t, tlsC)
 	})
 }
 
 func TestEncryptedKeyPassphrase(t *testing.T) {
 	const passphrase = "Abcd1234!" // passphrase for testdata/ca.encrypted.key
+	logger := logptest.NewTestingLogger(t, "")
 	t.Run("no passphrase", func(t *testing.T) {
 		_, err := LoadTLSConfig(mustLoad(t, `
     enabled: true
     certificate: testdata/ca.crt
     key: testdata/ca.encrypted.key
-    `))
+    `), logger)
 		assert.ErrorContains(t, err, "no PEM blocks") // ReadPEMFile will generate an internal "no passphrase available" error that is logged and the no PEM blocks error is returned instead
 	})
 
@@ -90,7 +92,7 @@ func TestEncryptedKeyPassphrase(t *testing.T) {
     certificate: testdata/ca.crt
     key: testdata/ca.encrypted.key
     key_passphrase: "abcd1234!"
-    `))
+    `), logger)
 		assert.ErrorContains(t, err, "no PEM blocks") // ReadPEMFile will fail decrypting with x509.IncorrectPasswordError that will be logged and a no PEM blocks error is returned instead
 	})
 
@@ -100,7 +102,7 @@ func TestEncryptedKeyPassphrase(t *testing.T) {
     certificate: testdata/ca.crt
     key: testdata/ca.encrypted.key
     key_passphrase: Abcd1234!
-    `))
+    `), logger)
 		require.NoError(t, err)
 		assert.Equal(t, 1, len(cfg.Certificates), "expected 1 certificate to be loaded")
 	})
@@ -112,7 +114,7 @@ func TestEncryptedKeyPassphrase(t *testing.T) {
     certificate: testdata/ca.crt
     key: testdata/ca.encrypted.key
     key_passphrase_path: %s
-    `, fileName)))
+    `, fileName)), logger)
 		require.NoError(t, err)
 		assert.Equal(t, 1, len(cfg.Certificates), "expected 1 certificate to be loaded")
 	})
@@ -124,7 +126,7 @@ func TestEncryptedKeyPassphrase(t *testing.T) {
     certificate: testdata/ca.crt
     key: testdata/ca.encrypted.key
     key_passphrase_path: %s
-    `, fileName)))
+    `, fileName)), logger)
 		assert.ErrorContains(t, err, "no PEM blocks") // ReadPEMFile will generate an internal "no passphrase available" error that is logged and the no PEM blocks error is returned instead
 	})
 }
diff --git a/transport/tlscommon/tls_test.go b/transport/tlscommon/tls_test.go

Original file line number	Diff line number	Diff line change
`@@ -185,7 +185,8 @@ func (settings HTTPTransportSettings) Unpack(cfg config.C) error {`
`185`	`185`	`return err`
`186`	`186`	`}`
`187`	`187`
`188`		`- _, err := tlscommon.LoadTLSConfig(tmp.TLS)`
	`188`	`+ // TODO: use local logger here`
	`189`	`+ _, err := tlscommon.LoadTLSConfig(tmp.TLS, logp.NewLogger(""))`
`189`	`190`	`if err != nil {`
`190`	`191`	`return err`
`191`	`192`	`}`
`@@ -213,6 +214,11 @@ func (settings *HTTPTransportSettings) RoundTripper(opts ...TransportOption) (ht`
`213`	`214`	`}`
`214`	`215`	`}`
`215`	`216`
	`217`	`+ logger := logp.NewLogger("")`
	`218`	`+ if log := extra.logger; log != nil {`
	`219`	`+ logger = log`
	`220`	`+ }`
	`221`	`+`
`216`	`222`	`for _, opt := range opts {`
`217`	`223`	`if dialOpt, ok := opt.(dialerOption); ok {`
`218`	`224`	`dialer = dialOpt.baseDialer()`
`@@ -223,7 +229,7 @@ func (settings *HTTPTransportSettings) RoundTripper(opts ...TransportOption) (ht`
`223`	`229`	`dialer = transport.NetDialer(settings.Timeout)`
`224`	`230`	`}`
`225`	`231`
`226`		`- tls, err := tlscommon.LoadTLSConfig(settings.TLS)`
	`232`	`+ tls, err := tlscommon.LoadTLSConfig(settings.TLS, logger)`
`227`	`233`	`if err != nil {`
`228`	`234`	`return nil, err`
`229`	`235`	`}`
Original file line number	Diff line number	Diff line change
`@@ -23,6 +23,7 @@ import (`
`23`	`23`	`"fmt"`
`24`	`24`
`25`	`25`	`"github.com/elastic/elastic-agent-libs/config"`
	`26`	`+ "github.com/elastic/elastic-agent-libs/logp"`
`26`	`27`	`)`
`27`	`28`
`28`	`29`	`// ServerConfig defines the user configurable tls options for any TCP based service.`
`@@ -40,7 +41,7 @@ type ServerConfig struct {`
`40`	`41`
`41`	`42`	// LoadTLSServerConfig tranforms a ServerConfig into a `tls.Config` to be used directly with golang
`42`	`43`	`// network types.`
`43`		`-func LoadTLSServerConfig(config ServerConfig) (TLSConfig, error) {`
	`44`	`+func LoadTLSServerConfig(config ServerConfig, logger logp.Logger) (*TLSConfig, error) {`
`44`	`45`	`if !config.IsEnabled() {`
`45`	`46`	`return nil, nil`
`46`	`47`	`}`
`@@ -95,6 +96,7 @@ func LoadTLSServerConfig(config ServerConfig) (TLSConfig, error) {`
`95`	`96`	`CurvePreferences: curves,`
`96`	`97`	`ClientAuth: tls.ClientAuthType(clientAuth),`
`97`	`98`	`CASha256: config.CASha256,`
	`99`	`+ logger: logger,`
`98`	`100`	`}, nil`
`99`	`101`	`}`
`100`	`102`
Original file line number	Diff line number	Diff line change
`@@ -86,6 +86,8 @@ type TLSConfig struct {`
`86`	`86`	`// time returns the current time as the number of seconds since the epoch.`
`87`	`87`	`// If time is nil, TLS uses time.Now.`
`88`	`88`	`time func() time.Time`
	`89`	`+`
	`90`	`+ logger *logp.Logger`
`89`	`91`	`}`
`90`	`92`
`91`	`93`	`var (`
`@@ -104,7 +106,7 @@ func (c TLSConfig) ToConfig() tls.Config {`
`104`	`106`
`105`	`107`	`insecure := c.Verification != VerifyStrict`
`106`	`108`	`if c.Verification == VerifyNone {`
`107`		`- logp.NewLogger("tls").Warn("SSL/TLS verifications disabled.")`
	`109`	`+ c.logger.Named("tls").Warn("SSL/TLS verifications disabled.")`
`108`	`110`	`}`
`109`	`111`
`110`	`112`	`return &tls.Config{`
`@@ -119,7 +121,7 @@ func (c TLSConfig) ToConfig() tls.Config {`
`119`	`121`	`Renegotiation: c.Renegotiation,`
`120`	`122`	`ClientAuth: c.ClientAuth,`
`121`	`123`	`Time: c.time,`
`122`		`- VerifyConnection: makeVerifyConnection(c),`
	`124`	`+ VerifyConnection: makeVerifyConnection(c, c.logger),`
`123`	`125`	`}`
`124`	`126`	`}`
`125`	`127`
`@@ -133,7 +135,7 @@ func (c TLSConfig) BuildModuleClientConfig(host string) tls.Config {`
`133`	`135`	`VerifyConnection: makeVerifyConnection(&TLSConfig{`
`134`	`136`	`Verification: VerifyFull,`
`135`	`137`	`ServerName: host,`
`136`		`- }),`
	`138`	`+ }, logp.NewLogger("tls")),`
`137`	`139`	`}`
`138`	`140`	`}`
`139`	`141`
`@@ -175,8 +177,8 @@ func (c TLSConfig) BuildServerConfig(host string) tls.Config {`
`175`	`177`	`return config`
`176`	`178`	`}`
`177`	`179`
`178`		`-func trustRootCA(cfg TLSConfig, peerCerts []x509.Certificate) error {`
`179`		`- logger := logp.NewLogger("tls")`
	`180`	`+func trustRootCA(cfg TLSConfig, peerCerts []x509.Certificate, logger *logp.Logger) error {`
	`181`	`+ logger = logger.Named("tls")`
`180`	`182`	`logger.Info("'ca_trusted_fingerprint' set, looking for matching fingerprints")`
`181`	`183`	`fingerprint, err := hex.DecodeString(cfg.CATrustedFingerprint)`
`182`	`184`	`if err != nil {`
`@@ -223,7 +225,7 @@ func trustRootCA(cfg TLSConfig, peerCerts []x509.Certificate) error {`
`223`	`225`	`return nil`
`224`	`226`	`}`
`225`	`227`
`226`		`-func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {`
	`228`	`+func makeVerifyConnection(cfg TLSConfig, logger logp.Logger) func(tls.ConnectionState) error {`
`227`	`229`	`serverName := cfg.ServerName`
`228`	`230`
`229`	`231`	`switch cfg.Verification {`
`@@ -233,7 +235,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {`
`233`	`235`	`// tls.Config.InsecureSkipVerify is set to true`
`234`	`236`	`return func(cs tls.ConnectionState) error {`
`235`	`237`	`if cfg.CATrustedFingerprint != "" {`
`236`		`- if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {`
	`238`	`+ if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {`
`237`	`239`	`return err`
`238`	`240`	`}`
`239`	`241`	`}`
`@@ -259,7 +261,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {`
`259`	`261`	`// tls.Config.InsecureSkipVerify is set to true`
`260`	`262`	`return func(cs tls.ConnectionState) error {`
`261`	`263`	`if cfg.CATrustedFingerprint != "" {`
`262`		`- if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {`
	`264`	`+ if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {`
`263`	`265`	`return err`
`264`	`266`	`}`
`265`	`267`	`}`
`@@ -284,7 +286,7 @@ func makeVerifyConnection(cfg *TLSConfig) func(tls.ConnectionState) error {`
`284`	`286`	`if len(cfg.CASha256) > 0 {`
`285`	`287`	`return func(cs tls.ConnectionState) error {`
`286`	`288`	`if cfg.CATrustedFingerprint != "" {`
`287`		`- if err := trustRootCA(cfg, cs.PeerCertificates); err != nil {`
	`289`	`+ if err := trustRootCA(cfg, cs.PeerCertificates, logger); err != nil {`
`288`	`290`	`return err`
`289`	`291`	`}`
`290`	`292`	`}`