mTLS Between Step-CA And MariaDB?

[Dulux-Oz]

Hi All,

I asked this question back in September 2024 in the "Hello mTLS" repo (and have yet to receive an answer). I've asked it again, here, now, because, apart from wanting an answer, MariaDB is now doing TLS by default and I'd also like to know how that plays into Smallsteps plans for Step-CA / Step-CLI?

+++++

Is it possible to do mTLS between Step-CA and a MariaDB Database Backend, or only "one-way" TLS from Step-CA to the MariaDB Backend?

If it is possible, did I simply miss the documentation on this (& could someone please point me in the right direction)? 😄

Please note that I am not asking about Step-CA facilitating mTLS between a MariaDB Database and another 3rd-Party application (I know how to do that, and have done so within our existing PKI), but between Step-CA itself and a MariaDB Database.

Thanks in advance

Dulux-Oz

[hslatman]

Hi @Dulux-Oz, currently this is not possible. Our nosql package uses https://github.com/go-sql-driver/mysql to connect to MariaDB. It currently has an issue open to support configuration of a client cert through DSN query parameters: go-sql-driver/mysql#1611. It is possible to handle a client certificate in code, but we don't have that implemented in nosql at the moment. For us it would be preferable if the SQL driver implemented it, so that we don't need additional code to handle that part of the configuration.

A workaround could be to leverage a database proxy handling the mTLS connection, and letting step-ca connect to the database through that.