httpclient: add support for tls.Config.GetClientCertificate

backend/http_settings.go

@@ -1,6 +1,7 @@
 package backend
 
 import (
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -36,6 +37,8 @@ type HTTPSettings struct {
 	TLSCACert         string
 	TLSClientCert     string
 	TLSClientKey      string
+	TLSClientCertFile string
+	TLSClientKeyFile  string
 
 	SigV4Auth          bool
 	SigV4Region        string
@@ -86,6 +89,15 @@ func (s *HTTPSettings) HTTPClientOptions() httpclient.Options {
 			InsecureSkipVerify: s.TLSSkipVerify,
 			ServerName:         s.TLSServerName,
 		}
+		if s.TLSClientCertFile != "" && s.TLSClientKeyFile != "" {
+			opts.TLS.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+				cert, err := tls.LoadX509KeyPair(s.TLSClientCertFile, s.TLSClientKeyFile)
+				if err != nil {
+					return nil, fmt.Errorf("failed to load X509 key pair: %w", err)
+				}
+				return &cert, nil
+			}
+		}
 	}
 
 	if s.SigV4Auth {
@@ -236,6 +248,12 @@ func parseHTTPSettings(jsonData json.RawMessage, secureJSONData map[string]strin
 		if v, exists := dat["serverName"]; exists {
 			s.TLSServerName = v.(string)
 		}
+		if v, exists := dat["tlsClientCertFile"]; exists {
+			s.TLSClientCertFile = v.(string)
+		}
+		if v, exists := dat["tlsClientKeyFile"]; exists {
+			s.TLSClientKeyFile = v.(string)
+		}
 		if v, exists := secureJSONData["tlsCACert"]; exists {
 			s.TLSCACert = v
 		}

backend/httpclient/http_client.go

@@ -153,6 +153,10 @@ func GetTLSConfig(opts ...Options) (*tls.Config, error) {
 		config.Certificates = []tls.Certificate{cert}
 	}
 
+	if tlsOpts.GetClientCertificate != nil {
+		config.GetClientCertificate = tlsOpts.GetClientCertificate
+	}
+
 	if tlsOpts.MinVersion > 0 {
 		config.MinVersion = tlsOpts.MinVersion
 	}

backend/httpclient/options.go

@@ -118,6 +118,10 @@ type TLSOptions struct {
 
 	// MaxVersion configures the tls.Config.MaxVersion.
 	MaxVersion uint16
+
+	// GetClientCertificate optionally provides a callback
+	// for getting client certificates.
+	GetClientCertificate func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
 }
 
 // SigV4Config AWS SigV4 options.