From 0d88a8d1e0c7d5e472d57c00b391054a486ec931 Mon Sep 17 00:00:00 2001
From: peg <ameba23@systemli.org>
Date: Thu, 1 Oct 2026 10:51:20 +0200
Subject: [PATCH] Allow client auth to be used with allow self-signed

---
 .../src/http/attested_get.rs                  |  2 +-
 crates/attested-tls-proxy/src/http/mod.rs     |  2 +-
 crates/attested-tls-proxy/src/main.rs         |  6 ++++--
 crates/attested-tls-proxy/src/self_signed.rs  | 21 ++++++++++++-------
 4 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/crates/attested-tls-proxy/src/http/attested_get.rs b/crates/attested-tls-proxy/src/http/attested_get.rs
index f543c30..ba2ddd9 100644
--- a/crates/attested-tls-proxy/src/http/attested_get.rs
+++ b/crates/attested-tls-proxy/src/http/attested_get.rs
@@ -33,7 +33,7 @@ pub async fn attested_get(
     allow_self_signed: bool,
 ) -> Result<reqwest::Response, ProxyError> {
     let proxy_client = if allow_self_signed {
-        let client_config = crate::self_signed::client_tls_config_allow_self_signed()?;
+        let client_config = crate::self_signed::client_tls_config_allow_self_signed(None)?;
         ProxyClient::new_with_tls_config(
             client_config,
             "127.0.0.1:0".to_string(),
diff --git a/crates/attested-tls-proxy/src/http/mod.rs b/crates/attested-tls-proxy/src/http/mod.rs
index 14a57da..29c4086 100644
--- a/crates/attested-tls-proxy/src/http/mod.rs
+++ b/crates/attested-tls-proxy/src/http/mod.rs
@@ -77,7 +77,7 @@ pub async fn get_tls_cert(
     allow_self_signed: bool,
 ) -> Result<(Vec<CertificateDer<'static>>, Option<MultiMeasurements>), AttestedTlsError> {
     let (cert, measurements) = if allow_self_signed {
-        let client_tls_config = self_signed::client_tls_config_allow_self_signed()?;
+        let client_tls_config = self_signed::client_tls_config_allow_self_signed(None)?;
         attested_tls::get_tls_cert_with_config(
             &server_name,
             attestation_verifier,
diff --git a/crates/attested-tls-proxy/src/main.rs b/crates/attested-tls-proxy/src/main.rs
index ba6efaa..0a9a7dd 100644
--- a/crates/attested-tls-proxy/src/main.rs
+++ b/crates/attested-tls-proxy/src/main.rs
@@ -304,14 +304,16 @@ async fn main() -> anyhow::Result<()> {
 
             let client = if allow_self_signed {
                 let client_tls_config =
-                    attested_tls_proxy::self_signed::client_tls_config_allow_self_signed()?;
+                    attested_tls_proxy::self_signed::client_tls_config_allow_self_signed(
+                        tls_cert_and_chain.as_ref(),
+                    )?;
                 ProxyClient::new_with_tls_config(
                     client_tls_config,
                     listen_addr,
                     target_addr,
                     client_attestation_generator,
                     attestation_verifier,
-                    None,
+                    tls_cert_and_chain.map(|identity| identity.cert_chain),
                 )
                 .await?
             } else {
diff --git a/crates/attested-tls-proxy/src/self_signed.rs b/crates/attested-tls-proxy/src/self_signed.rs
index 6d6322a..648f3a6 100644
--- a/crates/attested-tls-proxy/src/self_signed.rs
+++ b/crates/attested-tls-proxy/src/self_signed.rs
@@ -23,12 +23,19 @@ pub fn generate_self_signed_cert(ip_address: IpAddr) -> Result<TlsCertAndKey, rc
     })
 }
 
-/// Client TLS configuration which accepts self-signed remote certificates
-pub fn client_tls_config_allow_self_signed() -> Result<rustls::ClientConfig, AttestedTlsError> {
-    Ok(rustls::ClientConfig::builder()
+/// Accept self-signed remote certificates and optionally authenticate with a client identity.
+pub fn client_tls_config_allow_self_signed(
+    identity: Option<&TlsCertAndKey>,
+) -> Result<rustls::ClientConfig, AttestedTlsError> {
+    let builder = rustls::ClientConfig::builder()
         .dangerous()
-        .with_custom_certificate_verifier(SkipServerVerification::new()?)
-        .with_no_client_auth())
+        .with_custom_certificate_verifier(SkipServerVerification::new()?);
+    Ok(match identity {
+        Some(identity) => {
+            builder.with_client_auth_cert(identity.cert_chain.clone(), identity.key.clone_key())?
+        }
+        None => builder.with_no_client_auth(),
+    })
 }
 
 /// Used to allow verification of self-signed certificates
@@ -239,7 +246,7 @@ mod tests {
                 server.handle_connection(tcp_stream).await.unwrap();
         });
 
-        let client_config = client_tls_config_allow_self_signed().unwrap();
+        let client_config = client_tls_config_allow_self_signed(None).unwrap();
 
         let client = AttestedTlsClient::new_with_tls_config(
             client_config.into(),
@@ -297,7 +304,7 @@ mod tests {
         });
 
         // Inner TLS config
-        let client_config = client_tls_config_allow_self_signed().unwrap();
+        let client_config = client_tls_config_allow_self_signed(None).unwrap();
 
         let client = AttestedTlsClient::new_with_tls_config(
             client_config.into(),