feat(core): Add mTLS certificates for each request #5636
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sakilmostak
added
A-connector-integration
jarnura
previously approved these changes
Aug 19, 2024
Sakilmostak
changed the title
crates/router/Cargo.toml
Outdated
| @@ -93,7 +93,7 @@ rand = "0.8.5" | |||
| rand_chacha = "0.3.1" | |||
| rdkafka = "0.36.2" | |||
| regex = "1.10.4" | |||
| reqwest = { version = "0.11.27", features = ["json", "native-tls", "__rustls", "gzip", "multipart"] } | |||
| reqwest = { version = "0.11.27", features = ["json", "__rustls", "rustls-tls", "gzip", "multipart"] } | |||
There was a problem hiding this comment.
It should be sufficient to use rustls-tls alone, since that internally enables __rustls.
| @@ -105,7 +105,8 @@ pub fn create_identity_from_certificate_and_key( | |||
| let certificate_key = String::from_utf8(decoded_certificate_key) | |||
| .change_context(errors::ApiClientError::CertificateDecodeFailed)?; | |||
|
|
|||
| reqwest::Identity::from_pkcs8_pem(certificate.as_bytes(), certificate_key.as_bytes()) | |||
| let key_chain = format!("{}{}", certificate_key, certificate); | |||
There was a problem hiding this comment.
I think we can move create_identity_from_certificate_and_key() and create_certificate() to crates/router/src/services/api/client.rs file.
hyperswitch-bot
bot
added
the
M-api-contract-changes
SanchithHegde
approved these changes
Aug 26, 2024
jarnura
approved these changes
Aug 27, 2024
pixincreate
added a commit
that referenced
this pull request
Aug 27, 2024
…-key-check * 'main' of github.com:juspay/hyperswitch: feat(core): Add mTLS certificates for each request (#5636) refactor(open_banking): Added merchant data update in mca update (#5655) feat: add test_mode for quickly testing payout links (#5669) refactor: introduce a domain type for profile ID (#5687) ci(cypress): update paybox configs (#5664) feat(openapi): Add open api routes for routing v2 (#5686) feat(connector): [NOVALNET] Add template code (#5670) feat(user): business email update (#5674) chore(config): add production connector-configs for netcetera external 3ds flow (#5698) chore(version): 2024.08.27.0 refactor(euclid): make the disabled node's relation as negative (#5701) feat: populate payment method details in payments response (#5661) build(deps): bump `diesel` to `2.2.3` and `sqlx` to `0.8.1` (#5688) feat(customer_v2): added list customer v2 end point (#5517) feat(business_profile): add tax_connector_id column in business_profile table (#5576) chore: create v2 route for organization (#5679) refactor(payments_response): remove setter from payments response (#5676) feat(payment_methods_v2): Payment methods v2 API models (#5564) chore(version): 2024.08.26.0
pixincreate
added a commit
that referenced
this pull request
Aug 28, 2024
* 'main' of github.com:juspay/hyperswitch: feat(connector): [FISERVEMEA] Integrate cards (#5672) ci(cypress): Add routing testcases (#5571) fix(router): skip external three_ds flow for recurring payments (#5730) refactor(customer_v2): fixed customer_v2 create panic issue (#5699) feat(user_roles): support switch for new hierarchy (#5692) refactor(router): add domain type for merchant_connector_account id (#5685) refactor(cypress_tests): handle api keys check in api key list call (#5719) feat(connector): [NEXIXPAY] Add template code (#5684) refactor(connector): [itau] refactor error reason and code mapping for itau (#5718) fix(core): fix merchant connector account create for v2 (#5716) chore(version): 2024.08.28.0 fix(routing): fix routing routes to deserialise correctly (#5724) feat(euclid): add a new variant in payment type i.e ppt_mandate (#5681) feat(core): Add mTLS certificates for each request (#5636)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of Change
Description
Itau bank needs mTLS in production for verification of the request. Certificates (rootCA and pubkey) needs to be passed along with each request for Itau to verify.
Note: To send the certificates, all related certificates needs to be concatenated and put into .pem extenstion and then should be base64 encoded
Private key should also be base64 encoded before passing into the field
Additional Changes
Motivation and Context
How did you test it?
This can only be tested in production since sandbox doesn't support mTLS.
Note: Apple pay (with any enabled connector), Netcetera and normal payment (with any connector) should be tested in sandbox since it affects there flows.
The above flows have been sanity tested on integ environment for this PR
Checklist
cargo +nightly fmt --allcargo clippy