web: reject a client CA that holds no certificates

web/testdata/tls-ca-chain-invalid.pem

@@ -0,0 +1,2 @@
+This file is intentionally not a PEM encoded certificate. It stands in for a
+truncated, DER encoded or otherwise unusable CA bundle.

web/testdata/web_config_auth_clientCAsText_nocerts.bad.yml

@@ -0,0 +1,5 @@
+tls_server_config:
+  cert_file: "server.crt"
+  key_file: "server.key"
+  client_auth_type: "RequireAndVerifyClientCert"
+  client_ca: "this is not a PEM encoded certificate"

web/testdata/web_config_auth_clientCAs_nocerts.bad.yml

@@ -0,0 +1,5 @@
+tls_server_config:
+  cert_file: "server.crt"
+  key_file: "server.key"
+  client_auth_type: "RequireAndVerifyClientCert"
+  client_ca_file: "tls-ca-chain-invalid.pem"

web/tls_config.go

@@ -272,17 +272,26 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
 		cfg.CurvePreferences = cp
 	}
 
+	// clientCAsErr records that a client CA was configured but held no usable
+	// certificate. It is reported after the client auth policy has been
+	// validated, so that a configuration carrying both faults keeps reporting
+	// the policy one.
+	var clientCAsErr error
 	if c.ClientCAs != "" {
 		clientCAPool := x509.NewCertPool()
 		clientCAFile, err := os.ReadFile(c.ClientCAs)
 		if err != nil {
 			return nil, err
 		}
-		clientCAPool.AppendCertsFromPEM(clientCAFile)
+		if !clientCAPool.AppendCertsFromPEM(clientCAFile) {
+			clientCAsErr = fmt.Errorf("no client CA certificates found in client_ca_file (%s)", c.ClientCAs)
+		}
 		cfg.ClientCAs = clientCAPool
 	} else if c.ClientCAsText != "" {
 		clientCAPool := x509.NewCertPool()
-		clientCAPool.AppendCertsFromPEM([]byte(c.ClientCAsText))
+		if !clientCAPool.AppendCertsFromPEM([]byte(c.ClientCAsText)) {
+			clientCAsErr = errors.New("no client CA certificates found in client_ca")
+		}
 		cfg.ClientCAs = clientCAPool
 	}
 
@@ -310,6 +319,10 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
 		return nil, errors.New("client CA's have been configured without a Client Auth Policy")
 	}
 
+	if clientCAsErr != nil {
+		return nil, clientCAsErr
+	}
+
 	return cfg, nil
 }
 

web/tls_config_test.go

@@ -48,6 +48,7 @@ var (
 		"Invalid Cert or CertPath":     regexp.MustCompile(`missing one of cert or cert_file`),
 		"Invalid Key or KeyPath":       regexp.MustCompile(`missing one of key or key_file`),
 		"ClientCA set without policy":  regexp.MustCompile(`client CA's have been configured without a Client Auth Policy`),
+		"No client CA certificates":    regexp.MustCompile(`no client CA certificates found in client_ca`),
 		"Bad password":                 regexp.MustCompile(`hashedSecret too short to be a bcrypted password`),
 		"Unauthorized":                 regexp.MustCompile(`Unauthorized`),
 		"Forbidden":                    regexp.MustCompile(`Forbidden`),
@@ -167,6 +168,16 @@ func TestYAMLFiles(t *testing.T) {
 			YAMLConfigPath: "testdata/web_config_auth_clientCAs_invalid.bad.yml",
 			ExpectedError:  ErrorMap["No such file"],
 		},
+		{
+			Name:           `invalid config yml (client CA file without certificates)`,
+			YAMLConfigPath: "testdata/web_config_auth_clientCAs_nocerts.bad.yml",
+			ExpectedError:  ErrorMap["No client CA certificates"],
+		},
+		{
+			Name:           `invalid config yml (inline client CA without certificates)`,
+			YAMLConfigPath: "testdata/web_config_auth_clientCAsText_nocerts.bad.yml",
+			ExpectedError:  ErrorMap["No client CA certificates"],
+		},
 		{
 			Name:           `invalid config yml (invalid user list)`,
 			YAMLConfigPath: "testdata/web_config_auth_user_list_invalid.bad.yml",