Preserve TLS client certificate configuration

[mbuckton]

What changed

• read client-certificate flags from the located security.tls configuration
• expose a peer principal when either required or optional client authentication is enabled
• add regression coverage for nested TLS configuration

Root cause

SslConfig located the nested TLS block but read clientCertificateRequired and clientCertificateWanted from the outer endpoint configuration. SSLEndPoint also restricted principal extraction to required authentication only.

Impact

Configured client-certificate modes now reach the SSL engine, and optionally supplied client certificates can contribute the endpoint principal.

Validation

Added a unit test for nested security.tls client-certificate settings.

Dependency

The mandatory-handshake enforcement fix is in the companion authentication_library pull request from the same branch name.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5994b75e-3ddf-4720-9b9d-a70397f63f1c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mbuckton]

Superseded by #2162, rebuilt from the development branch with the complete TLS/DTLS security fixes and regression coverage.