Aswin-V · Nov 11, 2026 · Nov 10, 2026 · sourcery-ai · Nov 10, 2026 · sourcery-ai
@@ -36,10 +36,18 @@ func main() {
 	log.Printf("EIPC client connecting to %s as %s", addr, serviceID)
 
 	tcpTransport := tcp.New()
-	if err := tcpTransport.SetupTLSFromEnv(); err != nil {
+	if err := tcpTransport.SetupClientTLSFromEnv(); err != nil {
 		log.Fatalf("TLS setup: %v", err)
 	}
 
+	// The mode is read off the transport, not the environment: with no
+	// CA configured the dial is plaintext, and the log must say so.
+	tlsMode := "plaintext"
+	if tcpTransport.TLSEnabled() {
+		tlsMode = "TLS (verified)"
+	}
+	log.Printf("transport: %s", tlsMode)
+
 	conn, err := tcpTransport.Dial(addr)
 	if err != nil {
 		log.Fatalf("dial: %v", err)
@@ -224,7 +232,7 @@ func main() {
 	fmt.Println()
 	fmt.Println("=== EIPC Demo Complete (Hardened) ===")
 	fmt.Println("End-to-end flow demonstrated:")
-	fmt.Println("  1. Client connected to server (TLS if configured)")
+	fmt.Printf("  1. Client connected to server (%s)\n", tlsMode)
 	fmt.Println("  2. Server sent challenge nonce")
 	fmt.Println("  3. Client proved secret via HMAC-SHA256 response")
 	fmt.Println("  4. Server validated & issued session token")

@@ -295,7 +295,7 @@ func main() {
 	defer tcpTransport.Close()
 
 	tlsMode := "plaintext"
-	if config.TLSEnabled() {
+	if tcpTransport.TLSEnabled() {
 		tlsMode = "TLS"
 	}
 	log.Printf("EIPC server listening on %s [%s] (max_conns=%d, session_ttl=%s)",

@@ -61,7 +61,13 @@ func LoadListenAddr() string {
 	return "127.0.0.1:9090"
 }
 
-// TLSEnabled returns true if TLS cert files are configured or auto-cert is enabled.
+// TLSEnabled returns true if the TLS environment will actually engage the
+// server transport: a cert/key pair, or auto-cert. A lone EIPC_TLS_CERT
+// without EIPC_TLS_KEY does not engage TLS (SetupTLSFromEnv rejects a
+// half-configured pair), so it must not report enabled here either —
+// reporting it enabled is what let the server log [TLS] on a plaintext
+// socket.
 func TLSEnabled() bool {
-	return os.Getenv("EIPC_TLS_CERT") != "" || os.Getenv("EIPC_TLS_AUTO_CERT") == "true"
+	cert, key := os.Getenv("EIPC_TLS_CERT"), os.Getenv("EIPC_TLS_KEY")
+	return (cert != "" && key != "") || os.Getenv("EIPC_TLS_AUTO_CERT") == "true"
 }
@@ -139,15 +139,25 @@ func TestLoadListenAddr_Custom(t *testing.T) {
 
 func TestTLSEnabled(t *testing.T) {
 	os.Unsetenv("EIPC_TLS_CERT")
+	os.Unsetenv("EIPC_TLS_KEY")
 	os.Unsetenv("EIPC_TLS_AUTO_CERT")
 	if TLSEnabled() {
 		t.Error("TLS should be disabled by default")
 	}
 
+	// A lone cert without its key does not engage TLS: SetupTLSFromEnv
+	// rejects the half-configured pair, so the predicate must not
+	// report enabled either — that was the [TLS]-on-plaintext lie.
 	os.Setenv("EIPC_TLS_CERT", "/path/to/cert.pem")
 	defer os.Unsetenv("EIPC_TLS_CERT")
+	if TLSEnabled() {
+		t.Error("TLS should be disabled with EIPC_TLS_CERT set but no EIPC_TLS_KEY")
+	}
+
+	os.Setenv("EIPC_TLS_KEY", "/path/to/key.pem")
+	defer os.Unsetenv("EIPC_TLS_KEY")
 	if !TLSEnabled() {
-		t.Error("TLS should be enabled with EIPC_TLS_CERT set")
+		t.Error("TLS should be enabled with EIPC_TLS_CERT and EIPC_TLS_KEY set")
 	}
 }
 

@@ -516,4 +516,4 @@ Environment variable configuration loader.
 | `LoadSessionTTL()` | `EIPC_SESSION_TTL` | `1h` | Session lifetime |
 | `LoadMaxConnections()` | `EIPC_MAX_CONNECTIONS` | `64` | Max concurrent connections |
 | `LoadListenAddr()` | `EIPC_LISTEN_ADDR` | `127.0.0.1:9090` | Server listen address |
-| `TLSEnabled()` | `EIPC_TLS_CERT` or `EIPC_TLS_AUTO_CERT` | `false` | TLS mode check |
+| `TLSEnabled()` | `EIPC_TLS_CERT` + `EIPC_TLS_KEY`, or `EIPC_TLS_AUTO_CERT` | `false` | TLS mode check (true only when TLS will actually engage) |
@@ -343,4 +343,5 @@ Events captured:
 | `EIPC_MAX_CONNECTIONS` | Max concurrent connections | `64` |
 | `EIPC_TLS_CERT` | TLS certificate path | — |
 | `EIPC_TLS_KEY` | TLS private key path | — |
+| `EIPC_TLS_CA` | CA bundle the client trusts to verify the server (RootCAs); also the mTLS CA on the server | — |
 | `EIPC_TLS_AUTO_CERT` | Auto-generate self-signed cert | `false` |
@@ -42,7 +42,17 @@ func (t *Transport) WithTLSConfig(cfg *tls.Config) {
 	t.tlsConfig = cfg
 }
 
-// Listen starts a TCP listener on the given address (e.g. "127.0.0.1:9090").
+// TLSEnabled reports whether this transport will actually negotiate TLS:
+// true only when a TLS config has been set (WithTLS, WithTLSConfig,
+// SetupTLSFromEnv, SetupClientTLSFromEnv). This is the ground truth for
+// log labels — it must be used instead of sniffing the TLS environment
+// variables, which can claim TLS while the socket stays plaintext.
+func (t *Transport) TLSEnabled() bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.tlsConfig != nil
+}
+
 // If TLS is configured, wraps listener with tls.NewListener.
 func (t *Transport) Listen(address string) error {
 	t.mu.Lock()
@@ -129,14 +139,23 @@ func (t *Transport) Addr() string {
 	return ""
 }
 
-// SetupTLSFromEnv configures TLS from environment variables.
+// SetupTLSFromEnv configures server-side TLS from environment variables.
 // EIPC_TLS_CERT, EIPC_TLS_KEY for cert/key files.
 // EIPC_TLS_CA for mTLS CA file.
 // EIPC_TLS_AUTO_CERT=true for auto-generated self-signed cert.
+//
+// A cert path without its key path (or vice versa) is an error, not a
+// silent fall back to plaintext: a half-configured server must fail
+// loudly at startup rather than listen unencrypted while the operator
+// believes TLS is on.
 func (t *Transport) SetupTLSFromEnv() error {
 	certFile := os.Getenv("EIPC_TLS_CERT")
 	keyFile := os.Getenv("EIPC_TLS_KEY")
 
+	if (certFile == "") != (keyFile == "") {
+		return fmt.Errorf("EIPC_TLS_CERT and EIPC_TLS_KEY must be set together")
+	}
-	if (certFile == "") != (keyFile == "") {
-		return fmt.Errorf("EIPC_TLS_CERT and EIPC_TLS_KEY must be set together")
-	}
+	if (certFile == "") != (keyFile == "") {
+		return fmt.Errorf("EIPC_TLS_CERT and EIPC_TLS_KEY must be set together")
+	}
+	if certFile == "" && os.Getenv("EIPC_TLS_CA") != "" {
+		return fmt.Errorf("EIPC_TLS_CA requires EIPC_TLS_CERT and EIPC_TLS_KEY for server mTLS")
+	}
-	if (certFile == "") != (keyFile == "") {
-		return fmt.Errorf("EIPC_TLS_CERT and EIPC_TLS_KEY must be set together")
-	}
+	if (certFile == "") != (keyFile == "") {
+		return fmt.Errorf("EIPC_TLS_CERT and EIPC_TLS_KEY must be set together")
+	}
+	if certFile == "" && os.Getenv("EIPC_TLS_CA") != "" {
+		return fmt.Errorf("EIPC_TLS_CA requires EIPC_TLS_CERT and EIPC_TLS_KEY for server mTLS")
+	}
+
 	if certFile != "" && keyFile != "" {
 		return t.WithTLS(certFile, keyFile, os.Getenv("EIPC_TLS_CA"))
 	}
@@ -152,3 +171,33 @@ func (t *Transport) SetupTLSFromEnv() error {
 
 	return nil
 }
+
+// SetupClientTLSFromEnv configures client-side TLS from environment
+// variables, for dialing a server whose certificate must be verified.
+// EIPC_TLS_CA is the CA bundle the server is verified against (RootCAs);
+// without it the client verifies against the system roots.
+// EIPC_TLS_CERT/EIPC_TLS_KEY optionally present a client certificate
+// for mTLS; they must be set together.
+//
+// This is the client counterpart of SetupTLSFromEnv and the only env
+// setup a dialing client should use: the server setup builds a config
+// with Certificates/ClientCAs and never RootCAs, so a client built from
+// it cannot verify any server certificate and the only working dial was
+// InsecureSkipVerify. EIPC_TLS_AUTO_CERT is ignored here — minting a
+// self-signed certificate creates a server identity, not client trust.
+func (t *Transport) SetupClientTLSFromEnv() error {
+	caFile := os.Getenv("EIPC_TLS_CA")
+	certFile := os.Getenv("EIPC_TLS_CERT")
+	keyFile := os.Getenv("EIPC_TLS_KEY")
+
+	if caFile == "" && certFile == "" && keyFile == "" {
+		return nil
+	}
+
+	cfg, err := LoadClientTLSConfig(caFile, certFile, keyFile)
+	if err != nil {
+		return err
+	}
+	t.tlsConfig = cfg
+	return nil
+}