Client proxy mTLS support

[danestig]

I need to send HTTP traffic though a proxy that requires mutual TLS authentication. There currently is no way to provide the required certificates to the client to do this.

[jdegoes]

/bounty $100

[algora-pbc]

💎 $100 bounty created by ZIO
🙋 If you start working on this, comment /attempt #2211 to notify everyone
👉 To claim this bounty, submit a pull request that includes the text /claim #2211 somewhere in its body
📝 Before proceeding, please make sure you can receive payouts in your country
💵 Payment arrives in your account 2-5 days after the bounty is rewarded
💯 You keep 100% of the bounty award
🙏 Thank you for contributing to zio/zio-http!

Attempt	Started (GMT+0)	Solution
🟡 @rajcspsg	Jul 28, 2023, 10:49:39 PM	WIP

[rajcspsg]

/attempt #2211

[algora-pbc]

@rajcspsg: Reminder that in 7 days the bounty will become up for grabs, so please submit a pull request before then 🙏

[rajcspsg]

Hi @adamgfraser

This would be the approach that I would follow for this issue

1. create new SslConfig for client.
2. create a new field in ZClient for proxy SSLConfig.
3. copy the proxySSL config into createChannel function in NettyConnectionPool

Does it seem correct approach to proceed?

[adamseres]

Hi,

Thanks for working on this issue, I also need this feature to use zio-http.

I think that the ClientAuth is not what we need. I've never used it, but as far as understand, ClientAuth is used to configure the server connection to indicate the server's SSL requirement from the client.
https://netty.io/4.1/api/io/netty/handler/ssl/ClientAuth.html

Mutual TLS requires a keyManager in addition to the already implemented trustManager.
keyManager function has several implementations, I think it makes sense to support the same as for trustManager.

certFile

val keyCertChainInputStream: InputStream = ???
val keyInputStream: InputStream = ???
val keyPassword: String = ???

SslContextBuilder
  .forClient()
  .trustManager(new File(serverCertPath))
  .keyManager(keyCertChainInputStream, keyInputStream, keyPassword)
  .build()

keystore

val keystoreInput: InputStream = ???
val keyPassword: String = ???
val keystore: KeyStore = KeyStore.getInstance(KeyStore.getDefaultType)
val keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)

keystore.load(keystoreInput, keyPassword.toCharArray)
keyManagerFactory.init(keystore, keyPassword.toCharArray)

SslContextBuilder
  .forClient()
  .trustManager(new File(serverCertPath))
  .keyManager(keyManagerFactory)
  .build()

[rajcspsg]

Thanks @adamseres .
I'll update my PR with new implementation shortly.