cert-req-tls.zig

cert-req-tls.zig

// zig test cert-req-tls.zig
const server = "srctree.gr.ht";
const with_port: u16 = 443;
const without_port: u16 = 444;

test "with cert request" {
    const addr_list = try std.net.getAddressList(std.testing.allocator, server, with_port);
    defer addr_list.deinit();
    const conn = try std.net.tcpConnectToAddress(addr_list.addrs[0]);
    defer conn.close();

    var std_client = try std.crypto.tls.Client.init(conn, .{
        .host = .{ .explicit = server },
        .ca = .no_verification,
    });
    _ = try std_client.writeAllEnd(conn, "GET / HTTP/1.0\r\nHost: " ++ server ++ "\r\n\r\n", false);
    var read_buffer: [9000]u8 = undefined;
    const c = try std_client.readAll(conn, &read_buffer);
    const response = read_buffer[0..c];
    try std.testing.expect(std.mem.startsWith(u8, response, "HTTP/1.1 200 OK"));
    try std.testing.expect(std.mem.indexOf(u8, response, "\r\nServer: verse/0.1.") != null);
}

test "without cert request" {
    const addr_list = try std.net.getAddressList(std.testing.allocator, server, without_port);
    defer addr_list.deinit();
    const conn = try std.net.tcpConnectToAddress(addr_list.addrs[0]);
    defer conn.close();

    var std_client = try std.crypto.tls.Client.init(conn, .{
        .host = .{ .explicit = server },
        .ca = .no_verification,
    });
    _ = try std_client.writeAllEnd(conn, "GET / HTTP/1.0\r\nHost: " ++ server ++ "\r\n\r\n", false);
    var read_buffer: [9000]u8 = undefined;
    const c = try std_client.readAll(conn, &read_buffer);
    const response = read_buffer[0..c];
    try std.testing.expect(std.mem.startsWith(u8, response, "HTTP/1.1 200 OK"));
    try std.testing.expect(std.mem.indexOf(u8, response, "\r\nServer: verse/0.1.") != null);
}

const std = @import("std");

nginx-sample.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name server.name.tld;
    http2 on;
    ssl_certificate     /you/cert/here
    ssl_certificate_key /you/cert/here
    #ssl_dhparam         /etc/nginx/dhparam.pem;

     # Uncomment the two following lines
     #ssl_client_certificate client_certs/mtls-cert.pem;
     #ssl_verify_client optional_no_ca;
     
     location / {
         root /srv/http/public_html;
     }
}