[DRAFT] Fix #214: Separate user cert-chain from PKCS#8 key

data/src/config/server.rs

@@ -74,6 +74,7 @@ impl Server {
                 accept_invalid_certs: self.dangerously_accept_invalid_certs,
                 root_cert_path: self.root_cert_path.as_ref(),
                 client_cert_path: self.sasl.as_ref().and_then(Sasl::external_cert),
+                client_key_path: self.sasl.as_ref().and_then(Sasl::external_key),
             }
         } else {
             connection::Security::Unsecured
@@ -97,8 +98,10 @@ pub enum Sasl {
         password: String,
     },
     External {
-        /// The path to PEM encoded X509 certificate for external auth
+        /// The path to PEM encoded X509 user certificate for external auth
         cert: PathBuf,
+        /// The path to PEM encoded PKCS#8 private key corresponding to the user certificate for external auth
+        key: Option<PathBuf>,
     },
 }
 
@@ -122,12 +125,20 @@ impl Sasl {
     }
 
     fn external_cert(&self) -> Option<&PathBuf> {
-        if let Self::External { cert } = self {
+        if let Self::External { cert, .. } = self {
             Some(cert)
         } else {
             None
         }
     }
+
+    fn external_key(&self) -> Option<&PathBuf> {
+        if let Self::External { cert, key, .. } = self {
+            Some(key.as_ref().unwrap_or(cert))
+        } else {
+            None
+        }
+    }
 }
 
 fn default_use_tls() -> bool {

irc/src/connection.rs

@@ -26,6 +26,7 @@ pub enum Security<'a> {
         accept_invalid_certs: bool,
         root_cert_path: Option<&'a PathBuf>,
         client_cert_path: Option<&'a PathBuf>,
+        client_key_path: Option<&'a PathBuf>,
     },
 }
 
@@ -44,6 +45,7 @@ impl Connection {
             accept_invalid_certs,
             root_cert_path,
             client_cert_path,
+            client_key_path,
         } = config.security
         {
             let mut builder = native_tls::TlsConnector::builder();
@@ -55,10 +57,11 @@ impl Connection {
                 builder.add_root_certificate(cert);
             }
 
-            if let Some(path) = client_cert_path {
-                let bytes = fs::read(path).await?;
-                let pkcs12_archive = Identity::from_pkcs8(&bytes, &bytes)?;
-                builder.identity(pkcs12_archive);
+            if let (Some(cert_path), Some(pkcs8_key_path)) = (client_cert_path, client_key_path) {
+                let cert_bytes = fs::read(cert_path).await?;
+                let pkcs8_key_bytes = fs::read(pkcs8_key_path).await?;
+                let identity = Identity::from_pkcs8(&cert_bytes, &pkcs8_key_bytes)?;
+                builder.identity(identity);
             }
 
             let tls = TlsConnector::from(builder.build()?)