-
Notifications
You must be signed in to change notification settings - Fork 72
inconsistency with c8y.proxy client authentication #3388
Description
Is your feature improvement request related to a problem? Please describe.
As pointed out by @didier-wenzek, there is an inconsistency when it comes to the client authentication configuration between the tedge file transfer service/api endpoint (e.g. localhost:8000) and the Cumulocity local proxy. Currently when tedge-agent is running on a child device, it just uses the http.client.auth.* settings for both the file transfer service and the c8y local proxy...however each of these endpoints can be configured to used different certificates (especially if the c8y local proxy and file transfer service are running on different devices.
Below shows the existing settings which are used both both accessing the file transfer service and the Cumulocity local proxy:
http.client.auth.cert_file Path to the certificate which is used by the agent when connecting to external services.
http.client.auth.key_file Path to the private key which is used by the agent when connecting to external services.
Describe the solution you'd like
Some further evaluation is required, however one suggestion would be:
- deprecate
http.client.auth.*and replace it with two settings:c8y.local_proxy.client.auth.*(though remember there are now cloud profiles, so this will need to be configured for each cloud profile as well)fts.client.auth.*(ortedge.api.client.auth.*?)
Describe alternatives you've considered
Additional context