Enable Mutual TLS

For an added level of security, you may enable Mutual TLS (MTLS) for the Authenticator service. This prevents unauthorized clients from fetching Corsha Creds from the service.

For an explanation of how MTLS works and its benefits, Cloudflare has provided a helpful document on Mutual TLS

Enabling MTLS for the Authenticator service is easy once you have a client key that is signed by a CA. To enable MTLS, you will need to provide the CA's public certificate.

To enable Mutual TLS, you need to set the authenticator.clientCertFile option in the config.yaml:

authenticator:
  # listen address for the authenticator service
  listen: 0.0.0.0:8083

  authServerTrustedMachine:
    url: "<fill in>"
  authServerUntrustedMachine:
    url: "<fill in>"

  loggingLevel: info
  writeTime: "2h"
  streamsDir: "/opt/corsha/authenticator"

  tlsServerCertFile: "/opt/corsha/ssl/server.crt"
  tlsServerKeyFile: "/opt/corsha/ssl/server.key"
  clientCertCAFile: "/opt/corsha/ssl/client-ca.crt"

Once the service has been configured you will need to configure your client with the client key pair in order to fetch a Corsha Cred.

For example, here is a request made with curl:

curl --cert ./client.crt --key ./client.key https://localhost:8083/api/v1/x-corsha-cred