Allow client auth to be used with allow self-signed

crates/attested-tls-proxy/src/http/attested_get.rs

@@ -33,7 +33,7 @@ pub async fn attested_get(
     allow_self_signed: bool,
 ) -> Result<reqwest::Response, ProxyError> {
     let proxy_client = if allow_self_signed {
-        let client_config = crate::self_signed::client_tls_config_allow_self_signed()?;
+        let client_config = crate::self_signed::client_tls_config_allow_self_signed(None)?;
         ProxyClient::new_with_tls_config(
             client_config,
             "127.0.0.1:0".to_string(),

crates/attested-tls-proxy/src/http/mod.rs

@@ -77,7 +77,7 @@ pub async fn get_tls_cert(
     allow_self_signed: bool,
 ) -> Result<(Vec<CertificateDer<'static>>, Option<MultiMeasurements>), AttestedTlsError> {
     let (cert, measurements) = if allow_self_signed {
-        let client_tls_config = self_signed::client_tls_config_allow_self_signed()?;
+        let client_tls_config = self_signed::client_tls_config_allow_self_signed(None)?;
         attested_tls::get_tls_cert_with_config(
             &server_name,
             attestation_verifier,

crates/attested-tls-proxy/src/main.rs

@@ -304,14 +304,16 @@ async fn main() -> anyhow::Result<()> {
 
             let client = if allow_self_signed {
                 let client_tls_config =
-                    attested_tls_proxy::self_signed::client_tls_config_allow_self_signed()?;
+                    attested_tls_proxy::self_signed::client_tls_config_allow_self_signed(
+                        tls_cert_and_chain.as_ref(),
+                    )?;
                 ProxyClient::new_with_tls_config(
                     client_tls_config,
                     listen_addr,
                     target_addr,
                     client_attestation_generator,
                     attestation_verifier,
-                    None,
+                    tls_cert_and_chain.map(|identity| identity.cert_chain),
                 )
                 .await?
             } else {

crates/attested-tls-proxy/src/self_signed.rs

@@ -23,12 +23,19 @@ pub fn generate_self_signed_cert(ip_address: IpAddr) -> Result<TlsCertAndKey, rc
     })
 }
 
-/// Client TLS configuration which accepts self-signed remote certificates
-pub fn client_tls_config_allow_self_signed() -> Result<rustls::ClientConfig, AttestedTlsError> {
-    Ok(rustls::ClientConfig::builder()
+/// Accept self-signed remote certificates and optionally authenticate with a client identity.
+pub fn client_tls_config_allow_self_signed(
+    identity: Option<&TlsCertAndKey>,
+) -> Result<rustls::ClientConfig, AttestedTlsError> {
+    let builder = rustls::ClientConfig::builder()
         .dangerous()
-        .with_custom_certificate_verifier(SkipServerVerification::new()?)
-        .with_no_client_auth())
+        .with_custom_certificate_verifier(SkipServerVerification::new()?);
+    Ok(match identity {
+        Some(identity) => {
+            builder.with_client_auth_cert(identity.cert_chain.clone(), identity.key.clone_key())?
+        }
+        None => builder.with_no_client_auth(),
+    })
 }
 
 /// Used to allow verification of self-signed certificates
@@ -239,7 +246,7 @@ mod tests {
                 server.handle_connection(tcp_stream).await.unwrap();
         });
 
-        let client_config = client_tls_config_allow_self_signed().unwrap();
+        let client_config = client_tls_config_allow_self_signed(None).unwrap();
 
         let client = AttestedTlsClient::new_with_tls_config(
             client_config.into(),
@@ -297,7 +304,7 @@ mod tests {
         });
 
         // Inner TLS config
-        let client_config = client_tls_config_allow_self_signed().unwrap();
+        let client_config = client_tls_config_allow_self_signed(None).unwrap();
 
         let client = AttestedTlsClient::new_with_tls_config(
             client_config.into(),