How to setup reqwest mTLS client with self signed certificates?

[Masber]

Dear reqwest community,

I am trying to create a reqwest client for mTLS and self signed certs. I have 3 certificate files:

• CA public cert
• client key
• client cert

This my code:

        let client = reqwest::blocking::ClientBuilder::new()
            .add_root_certificate(Certificate::from_pem(ca_cert)?)  // Load CA public cert
            .identity(Identity::from_pem(client_key)?)              // Load client key
            .identity(Identity::from_pem(client_cert)?)             // Load client public cert
            .use_rustls_tls()
            .build()?;

        let url_api = base_url.to_owned() + "/v1/jobs";

        let response_rslt = client
            .get(url_api)
            .send();

And this is the error I am getting:

thread 'main' panicked at src/cli/parser.rs:28:14:
called `Result::unwrap()` on an `Err` value: reqwest::Error { kind: Builder, source: General("private key or certificate not found") }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

I am assuming I can't use .identity twice for my 2 files (user key and user public cert)

Any idea on how to do this?

[Masber]

I also tried merging both client key and client cert into a single file like cat client-key.pem client-pub.pem > client-bundle.pem and:

        let mut buf = Vec::new();
        std::fs::File::open("client-bundle.pem")
            .unwrap()
            .read_to_end(&mut buf)
            .unwrap();

        // Call Nomad API
        let client = reqwest::blocking::ClientBuilder::new()
            .add_root_certificate(Certificate::from_pem(ca_cert)?)
            .identity(Identity::from_pem(&buf)?)
            .use_rustls_tls()
            .build()?;

        let url_api = base_url.to_owned() + "/v1/jobs";

        let response_rslt = client
            .get(url_api)
            .query(&[("namespace", namespace)])
            .send();

Public key looks like

$ openssl x509 -in client-bundle.pem -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:5e:75:ac:92:01:76:54:b7:f5:f6:17:34:21:24:e2
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = CA, L = San Francisco, street = 101 Second Street, postalCode = 94105, O = HashiCorp Inc., CN = Nomad Agent CA 333913092580072949141543148683969139565
        Validity
            Not Before: Jun  7 14:10:33 2024 GMT
            Not After : Jun  7 14:10:33 2026 GMT
        Subject: CN = client.global.nomad
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:6f:fc:93:68:1f:bf:4a:bf:83:b0:33:1e:61:da:
                    af:fe:3d:6e:a0:e4:44:dc:2c:6a:0c:71:b6:2c:90:
                    bb:d2:5c:e0:96:86:a3:49:a7:3a:ed:41:ff:1f:02:
                    f2:d9:95:72:67:b4:56:34:70:38:0e:fa:c1:ca:cf:
                    13:8a:07:fa:e2
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                D8:12:17:07:92:1E:44:EA:15:FD:8A:31:2E:DA:53:36:29:57:FC:73:27:DC:4C:A4:A2:CF:44:9E:5B:18:C0:60
            X509v3 Authority Key Identifier:
                C0:2B:36:DB:50:68:AA:F6:A0:2C:53:C7:FA:9B:76:95:49:17:8B:6F:FB:23:C3:CA:88:9B:EF:27:53:DD:ED:F3
            X509v3 Subject Alternative Name:
                DNS:client.global.nomad, DNS:localhost, IP Address:127.0.0.1
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:45:02:20:24:b1:11:f3:4d:d7:55:79:b7:d1:21:b8:82:92:
        1f:bd:0c:dc:c5:11:7f:70:9a:fa:8c:8c:26:2f:c8:19:68:a1:
        02:21:00:f2:7a:8c:56:69:48:8b:00:f8:d2:3e:9f:95:ed:a0:
        b3:ee:1d:f5:10:80:1b:4f:93:14:8e:67:cd:74:ae:f2:6e
-----BEGIN CERTIFICATE-----
MIICnzCCAkWgAwIBAgIQLl51rJIBdlS39fYXNCEk4jAKBggqhkjOPQQDAjCBuDEL
MAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
MRowGAYDVQQJExExMDEgU2Vjb25kIFN0cmVldDEOMAwGA1UEERMFOTQxMDUxFzAV
BgNVBAoTDkhhc2hpQ29ycCBJbmMuMT8wPQYDVQQDEzZOb21hZCBBZ2VudCBDQSAz
MzM5MTMwOTI1ODAwNzI5NDkxNDE1NDMxNDg2ODM5NjkxMzk1NjUwHhcNMjQwNjA3
MTQxMDMzWhcNMjYwNjA3MTQxMDMzWjAeMRwwGgYDVQQDExNjbGllbnQuZ2xvYmFs
Lm5vbWFkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEb/yTaB+/Sr+DsDMeYdqv
/j1uoORE3CxqDHG2LJC70lzgloajSac67UH/HwLy2ZVyZ7RWNHA4DvrBys8Tigf6
4qOByTCBxjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMAwGA1UdEwEB/wQCMAAwKQYDVR0OBCIEINgSFweSHkTqFf2KMS7aUzYp
V/xzJ9xMpKLPRJ5bGMBgMCsGA1UdIwQkMCKAIMArNttQaKr2oCxTx/qbdpVJF4tv
+yPDyoib7ydT3e3zMC8GA1UdEQQoMCaCE2NsaWVudC5nbG9iYWwubm9tYWSCCWxv
Y2FsaG9zdIcEfwAAATAKBggqhkjOPQQDAgNIADBFAiAksRHzTddVebfRIbiCkh+9
DNzFEX9wmvqMjCYvyBlooQIhAPJ6jFZpSIsA+NI+n5XtoLPuHfUQgBtPkxSOZ810
rvJu
-----END CERTIFICATE-----

Private key is PEM EC

And now I am getting this error:

thread 'main' panicked at src/cli/parser.rs:28:14:
called `Result::unwrap()` on an `Err` value: reqwest::Error { kind: Request, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("moleson0.cscs.ch")), port: Some(4646), path: "/v1/jobs", query: Some("namespace=default"), fragment: None }, source: hyper_util::client::legacy::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

any hint?

thank you very much

[fenollp]

This should help: #2011 (comment)