WSTunnel mTLS

[reuvenstr]

Hi,

I'm trying to set up mTLS using self-signed certificates.
The server side is working fine - I provided the client's CA certificate using a command-line flag(--tls-client-ca-certs).
However, the client side isn't working, even when I place the server's CA certificate in the operating system's CA folder. Works ok without this flag --tls-verify-certificate, but I need it to actual mTLS

Is it possible to configure the client to trust CAs from the OS, or should I also pass the CA certificate to the client explicitly using a flag that is missing on its side(--tls-client-ca-certs)

Currently I am using 10.1.8 version, if it's already fixed in future release, I will upgrade. From the code, I didn't see anything that can help

Thanks

[erebe]

Hello,

You need to pass the ca directly to the client. Check https://github.com/erebe/wstunnel/blob/main/docs/using_mtls.md#using-mtls-on-the-wstunnel-client-side
The client is not going to user the system store for mTLS

[reuvenstr]

Thanks for the fast reply!
Is there any way to provide CAs to client as well?
This one is not working

 error: unexpected argument '--tls-client-ca-certs' found
 tip: a similar argument exists: '--tls-certificate'

Any other suggestions?

[erebe]

Please read the documentation at https://github.com/erebe/wstunnel/blob/main/docs/using_mtls.md#using-mtls-on-the-wstunnel-client-side

$ wstunnel client \
   --tls-certificate ./certs/wstunnel-client-1.cert.pem \
   --tls-private-key ./private/wstunnel-client-1.pem \
   -L tcp://1212:localhost:1313 \
   wss://127.0.0.1:8443

[reuvenstr]

Sorry, but the documentation only talks about the server side, not the client side. Without the --tls-verify-certificate flag on the client, anyone can intercept the communication and present any certificate they want - and the client will accept it without any issues. Just for clarification, client and server are using different CA's for generation of their certificates and keys

Am I missing something?

[reuvenstr]

Any update?

[erebe]

It is in the documentation !