Add TLS CA-file override for private CAs (#13) - #18
Merged
Conversation
midge.readme and userdocs/index.md still said TLS was "planned for future releases" - stale since the AmiSSL transport landed and shipped in mqtt.library/mqtt_pub/mqtt_sub. Both now describe it as available (mco_TLS/TLS-TLSINSECORE, AmiSSL required separately, CPU-speed caveat). Installation.md gets a new "Installing AmiSSL (needed for TLS)" section alongside the existing mqtt.library install step - the missing piece a release user would actually need to discover TLS is usable at all. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9
Threads a new ca_file/mco_CAFile/-c/CAFILE option end-to-end through both TLS transports and both CLI flavors: - src/tools/tool_opts.h: new ca_file field, parsed by both host getopt (-c) and Amiga ReadArgs (CAFILE/K). - src/host/transport_openssl.c and src/amiga/transport_amissl.c: an extra SSL_CTX_load_verify_locations() call when ca_file is set, additive to the existing default trust store/AmiSSL cert store (not a replacement), so brokers behind a public CA keep verifying too. - mqtt.library: new mco_CAFile field on MqttConnectOpts, deep-copied at MQTT_CreateClient() time like the other string options, threaded through child_connect() into the AmiSSL branch. Host/library-linked Amiga CLIs pass their new -c/CAFILE value straight through; the static Amiga CLIs already reject TLS outright so need no change. - mqtt.doc/mqtt-library-reference.md and CLI-Reference.md updated (including host `-c` and Amiga `CAFILE`). Verified end-to-end on real m68k/AmiSSL under Copperline: a broker cert signed by a private CA correctly fails without the CA file and succeeds with it (both the host CLI and the real mqtt.library path). Along the way, found and documented a real gotcha for anyone doing certificate verification on Amiga: the guest clock matters a lot (a wrong or unseeded clock makes a good certificate look not-yet-valid/expired) - new "A note on TLS and the system clock" in CLI-Reference.md. Adds tests/library/libcafile.c + cafile-run.sh (make library-cafile-smoke), same local-only/amibake-image shape as the existing library-tls-smoke. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CAFILE/-cescape hatch for brokers behind a private CA, so certificate verification can stay on instead of falling back toTLSINSECURE/-S.ca_file/mco_CAFilefield threaded throughtool_opts, both TLS transports (transport_openssl.c,transport_amissl.c),mqtt.library'sMqttConnectOpts, and both CLI flavors (host-c, AmigaCAFILE/K).SSL_CTX_load_verify_locations()is additive on top of the existing default trust store / AmiSSL cert store, not a replacement - a broker behind a normal public CA still verifies too.mqtt.doc/mqtt-library-reference.mdregenerated,CLI-Reference.mdupdated with the new flags plus a new "A note on TLS and the system clock" section (see below).tests/library/libcafile.c+cafile-run.sh(make library-cafile-smoke), same local-only/amibake-image shape as the existinglibrary-tls-smoke.A real finding along the way
Verifying this on-target surfaced a genuine gotcha, now documented: the Amiga's system clock matters for certificate verification. A wrong/unseeded clock makes a good certificate look not-yet-valid or expired. The test harness itself hit this (Copperline's guest clock needs
--rtc-timeseeding, and even seeded there's enough skew - not pinned down further, not worth chasing for a test harness - to need certs backdated by a day for margin, seecafile-run.sh's banner comment).Test plan
mqtt_pub-host -s <broker with private-CA cert>fails without-c, succeeds with-c capath.pem.mco_CAFileAPI): confirmed the exact same behavior, and root-caused an initial on-target-only failure to the clock-skew issue above (not a code bug).sh tests/library/cafile-run.sh: full green run against an amibake-built AmigaOS 3.2.2 + AmiSSL image - both checks pass (no-cafile-connect-fails,with-cafile-connect-ok).sh tests/library/tls-run.sh(existingmco_TLStest, no CA file): still full green - no regression.make test: 249/249 host unit tests pass.mkdocs build --strictanddocs2guide.pyconversion both clean.make m68k,make library(with and withoutmake fetch-amissl-sdk),make cliall build with no warnings.🤖 Generated with Claude Code
https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9