Skip to content

Cargo mTLS registry authentication #3907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
matthague wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Cargo mTLS registry authentication #3907

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
73a123b
Create RFC for cargo mTLS support
Nov 19, 2025
905eb14
Update 0000-mtls-registry-authentication
matthague Nov 22, 2025
704d24f
Update RFC based on zulip feedback
Jan 17, 2026
e461aed
Merge branch 'master' of github.com:matthague/rfcs
Jan 17, 2026
92fdb37
Update file with PR number
Jan 17, 2026
3a16df3
Specify that certificates and keys use PEM format
Jan 17, 2026
24a2881
Remove double base64'ing of PEM formatted data
Jan 17, 2026
ae27ce7
Specify escaped newlines in certificate and key fields
matthague Jan 18, 2026
d1806de
Add explicit section on certificate and key format
Jan 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 4 additions & 11 deletions text/3907-mtls-registry-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,14 +51,10 @@ Cargo will issue a tls-identity request when configuring an HTTP client for a re
{"Ok":{
// Response kind: this was a TLS client identity request
"kind":"tls-identity",
// Base64 byte buffer containing the binary content of your client certificate (empty if unset)
"cert_blob":"aGVsbG8...gd29ybGQ=",
// The format of your client certificate. With the current curl-based backend, supported formats are “PEM”, “DER”, and "P12" (empty for backend default)
"cert_type":"PEM",
// Base64 byte buffer containing the binary content of your private key (empty if unset)
"key_blob":"aGVsbG8...gd29ybGQ=",
// The format of your private key. With the current curl-based backend, supported formats are “PEM” and “DER” (empty for backend default)
"key_type":"PEM",
// Base64 encoded byte buffer containing the binary content of your client certificate in PEM format (empty if unset)
"certificate":"aGVsbG8...gd29ybGQ=",
// Base64 encoded byte buffer containing the binary content of your private key in PEM format (empty if unset)
"key":"aGVsbG8...gd29ybGQ=",
Comment thread
bjorn3 marked this conversation as resolved.
Outdated
}}
```

Expand All @@ -68,12 +64,9 @@ Cargo will issue a tls-identity request when configuring an HTTP client for a re
The currently used crate for `libcurl` exposes methods for setting these certificates and keys, and can be used to set these configuration options when HTTP handles are being configured. These methods are:
* `curl::easy::Easy::ssl_cert_blob`
* `curl::easy::Easy::ssl_key_blob`
* `curl::easy::Easy::ssl_cert_type`
* `curl::easy::Easy::ssl_key_type`

These "easy" methods wrap well tested code in the curl source:
* https://github.com/curl/curl/blob/master/docs/libcurl/opts/CURLOPT_SSLKEY.md
* https://github.com/curl/curl/blob/master/docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md
* https://github.com/curl/curl/blob/master/docs/libcurl/opts/CURLOPT_SSLCERT.md

# Security Considerations
Expand Down