Skip to content

Allow separate client CA trust anchors for mTLS#363

Merged
bittcrafter merged 2 commits intormqtt:masterfrom
cr-boaz:fix/separate-client-cert-trust-anchors
Feb 9, 2026
Merged

Allow separate client CA trust anchors for mTLS#363
bittcrafter merged 2 commits intormqtt:masterfrom
cr-boaz:fix/separate-client-cert-trust-anchors

Conversation

@cr-boaz
Copy link
Copy Markdown
Contributor

@cr-boaz cr-boaz commented Feb 7, 2026

Summary

  • add optional client CA bundle configuration to listeners
  • build the mTLS verifier from the client CA bundle when provided (fallback to server cert chain)
  • reuse the shared TLS config builder for both TCP/TLS and QUIC listeners

Fixes #362

@bittcrafter
Copy link
Copy Markdown
Collaborator

Thanks a lot for the PR and the contribution!
I’ll take some time to review, verify, and test the changes before deciding on merging it into the main branch, so it may take a bit.

Appreciate your work and patience — thanks again!

@cr-boaz
Copy link
Copy Markdown
Contributor Author

cr-boaz commented Feb 7, 2026

Thank you for your quick reply! I hope this PR helps speed up fixing the issue.

- Add `client_ca_certs` configuration option to MQTT listeners
- Implement TLS client certificate verification in server builder
- Update configuration file with client CA cert example
- Fix code formatting and import ordering
@bittcrafter bittcrafter merged commit ac1a241 into rmqtt:master Feb 9, 2026
10 checks passed
@cr-boaz cr-boaz deleted the fix/separate-client-cert-trust-anchors branch February 10, 2026 02:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

When enabling mTLS, rmqtt is using the sever's certificate chain as the trust store

3 participants