proposed fix: x509: certificate signed by unknown authority

[pravus]

added loading of intermediate certificate chain into SSL context so clients can verify the server certificate properly

[pondix]

Automated message: PR pending admin approval for build testing

[JavierJF]

@pravus Hi! I have been reviewing the PR and I wanted to ask you which is your particular use case for needing to load the root CA certificate into the SSL context. This is an uncommon practice and it's many times contraindicated. Could you please elaborate why is this required for you? Thanks you!

[pravus]

@JavierJF

Hi! Our situation is that we are using a Let's Encrypt wildcard certificate that is signed by the X3 intermediary of the ISRG X1 root. Based on my own personal testing I was not able to get clients to properly connect to a ProxySQL instance with TLS enabled and the standard set of CA certificates. I was only able to get working connections after either altering the client's CA bundle, altering the client's CA/TLS settings directly, or using the patch I provided.

I am not a TLS expert but it has always been my understanding that while root certificates are installed on the system, intermediate certificates are generally distributed by services during connection negotiation. The intent of this change was to enable this behavior by providing the SSL context with the certificate chain which includes certificates that are not in the system bundle.

To be a little more generic, what I need is the ability to build a Docker container with a Go program installed along with the standard certificate bundle and have TLS connections work without having to install extra certificates or modifying the source of the Go program. The changes I have provided make this possible for me but if there is a better way to accomplish this then I am open to suggestions.

[JavierJF]

@pravus Hi! So, after discussing the current behavior of certificates added to the certificate chain, we have decided that we are going to add the root certificate by default, this is because after further investigation we have found that mysql also adds the root certificate to the certificate chain, so, for honoring that behavior, we are going to do the same. This means that this PR matches this new desired approach for the SSL chain. I'm going to review and merge it. Thanks!

[renecannao]

Thank you @pravus and @JavierJF