certstore

func GetClientCertificateFunc ¶

func GetClientCertificateFunc(
	issuerFilter, subjectFilter string,
) (func(*tls.CertificateRequestInfo) (*tls.Certificate, error), error)

GetClientCertificateFunc returns a function suitable for use as a tls.Config.GetClientCertificate callback. This function searches for a client certificate in the system trust store according to the list of acceptable CA names from the Certificate Request message, with optional additional filter conditions based on the Issuer name and/or the Subject name in the end-entity certificate.

Filter conditions should be of the form "attribute=value", e.g. "CN=my cert name". Each condition may include at most one attribute/value pair. Only attributes corresponding to named fields of pkix.Name may be used (attribute keys are compared case-insensitively). These attributes are:

• commonName (CN)
• countryName (C)
• localityName (L)
• organizationName (O)
• organizationalUnitName (OU)
• postalCode
• serialNumber
• stateOrProvinceName (ST)
• streetAddress (STREET)

Names containing multiple values for the same attribute are not supported.