Cherrypick client-{client,key}-file parameter support into 3.4 release branch

embed/config.go

@@ -370,11 +370,13 @@ type configJSON struct {
 }
 
 type securityConfig struct {
-	CertFile      string `json:"cert-file"`
-	KeyFile       string `json:"key-file"`
-	CertAuth      bool   `json:"client-cert-auth"`
-	TrustedCAFile string `json:"trusted-ca-file"`
-	AutoTLS       bool   `json:"auto-tls"`
+	CertFile       string `json:"cert-file"`
+	KeyFile        string `json:"key-file"`
+	ClientCertFile string `json:"client-cert-file"`
+	ClientKeyFile  string `json:"client-key-file"`
+	CertAuth       bool   `json:"client-cert-auth"`
+	TrustedCAFile  string `json:"trusted-ca-file"`
+	AutoTLS        bool   `json:"auto-tls"`
 }
 
 // NewConfig creates a new Config populated with default values.
@@ -538,6 +540,8 @@ func (cfg *configYAML) configFromFile(path string) error {
 	copySecurityDetails := func(tls *transport.TLSInfo, ysc *securityConfig) {
 		tls.CertFile = ysc.CertFile
 		tls.KeyFile = ysc.KeyFile
+		tls.ClientCertFile = ysc.ClientCertFile
+		tls.ClientKeyFile = ysc.ClientKeyFile
 		tls.ClientCertAuth = ysc.CertAuth
 		tls.TrustedCAFile = ysc.TrustedCAFile
 	}

etcdmain/config.go

@@ -199,13 +199,17 @@ func newConfig() *config {
 	// security
 	fs.StringVar(&cfg.ec.ClientTLSInfo.CertFile, "cert-file", "", "Path to the client server TLS cert file.")
 	fs.StringVar(&cfg.ec.ClientTLSInfo.KeyFile, "key-file", "", "Path to the client server TLS key file.")
+	fs.StringVar(&cfg.ec.ClientTLSInfo.ClientCertFile, "client-cert-file", "", "Path to an explicit peer client TLS cert file otherwise cert file will be used when client auth is required.")
+	fs.StringVar(&cfg.ec.ClientTLSInfo.ClientKeyFile, "client-key-file", "", "Path to an explicit peer client TLS key file otherwise key file will be used when client auth is required.")
 	fs.BoolVar(&cfg.ec.ClientTLSInfo.ClientCertAuth, "client-cert-auth", false, "Enable client cert authentication.")
 	fs.StringVar(&cfg.ec.ClientTLSInfo.CRLFile, "client-crl-file", "", "Path to the client certificate revocation list file.")
 	fs.StringVar(&cfg.ec.ClientTLSInfo.AllowedHostname, "client-cert-allowed-hostname", "", "Allowed TLS hostname for client cert authentication.")
 	fs.StringVar(&cfg.ec.ClientTLSInfo.TrustedCAFile, "trusted-ca-file", "", "Path to the client server TLS trusted CA cert file.")
 	fs.BoolVar(&cfg.ec.ClientAutoTLS, "auto-tls", false, "Client TLS using generated certificates")
 	fs.StringVar(&cfg.ec.PeerTLSInfo.CertFile, "peer-cert-file", "", "Path to the peer server TLS cert file.")
 	fs.StringVar(&cfg.ec.PeerTLSInfo.KeyFile, "peer-key-file", "", "Path to the peer server TLS key file.")
+	fs.StringVar(&cfg.ec.PeerTLSInfo.ClientCertFile, "peer-client-cert-file", "", "Path to an explicit peer client TLS cert file otherwise peer cert file will be used when client auth is required.")
+	fs.StringVar(&cfg.ec.PeerTLSInfo.ClientKeyFile, "peer-client-key-file", "", "Path to an explicit peer client TLS key file otherwise peer key file will be used when client auth is required.")
 	fs.BoolVar(&cfg.ec.PeerTLSInfo.ClientCertAuth, "peer-client-cert-auth", false, "Enable peer client cert authentication.")
 	fs.StringVar(&cfg.ec.PeerTLSInfo.TrustedCAFile, "peer-trusted-ca-file", "", "Path to the peer server TLS trusted CA file.")
 	fs.BoolVar(&cfg.ec.PeerAutoTLS, "peer-auto-tls", false, "Peer TLS using generated certificates")

integration/fixtures/ca.crt

@@ -1,22 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIDrjCCApagAwIBAgIUOl7DCgSvqQKhiihYrZDiBKNpQX4wDQYJKoZIhvcNAQEL
+MIIDrjCCApagAwIBAgIUKgmToz/aC0mjKyzB9CVjW+kKtMEwDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMTAzMDUxMjEwMDBaFw0zMTAzMDMxMjEw
 MDBaMG8xDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTELMAkGA1UEAxMCY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDBNhwKD8oqOwNSDMZR+K6l6ocyXZzZPAIbv7co34xtjt25c8PPKz8FiBSU
-M4YeZpzsSp7n7WSSSzVWqFTRBZzvjIrBzLu4CfxMKuUrQX1/BPYgbSxQO+5YKPzO
-yaBMhIAEtW+WYsaa6PpWyL65L4giKpVoLS/UFTEBsf+lO6pwFpX2EJnIylLbpwEd
-pAXIgVFsodHlP9Zc2tR1TqYetmJ6/A/p5sSZpgLy1y2+Mg4VTMKvs2kNAoh/+lEu
-WPe204eMpkBXhukulOiJkVKNdhnCkLslt8ZaMWWqBvD9d94lXycMQ9wnGakPNc4W
-5VX3rbLOGOX7xK37BCsh5HGodIrZAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
-BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRlB76vjaZyFLrEUGm6DQfyjmN6PjAN
-BgkqhkiG9w0BAQsFAAOCAQEAD0cRNBQqOPNAUmKCH9xCr4TZFoE+P5aNePU39Jyp
-qpJ1HjKI93zBk9aN5udDGPFhm2/iaKx6DuABbxCz0LwNhLiKP6UbHV8F2fTJJ5bo
-crXvD0CEpor+Quh995lbq9bv29+zcDVw+Hw0QainBdHWkdw6RAgmbFnJxETDDz8z
-VQ0DET3T736oxpEZ4DKQlbzK5LSgZH2lyPEEvzci4QjTZf5X/nitdx7fAdMFFPQ0
-lI4l7nIuge5LTR0isEfWHx7Orx6l8dzkofG3fz5BjHCI4JInVlWq3MNNSybDI4pI
-GFxeuE/U8K6kIixT8qCAh6Naq9/xuxFkffLmMKfZXoYLCg==
+AoIBAQC6OhCSo2UlP0p5OX1IX3ukM0yC2wmjP26SF0AFtdb++PESlt9TXZxfzBb8
+cw1GNcv44H+1nLNgy91dLBR2AOsgg9qxGH7nwJE3o7XF/np/1SC58wjvu98l8cjy
+twxOGqYLcQIhpvUSwz1M05420NCRgIrV0EmkNhZgbkqVfJq4tntsyrlrL++XLwYX
+Sm9qtmts6gLxCY47+pF+8vy/b0MS800dgVccBtohK4I0QGsFhE1pF7lPikhxJUAz
+CXXRvt7Bb4gHKRymSR3+EC04hS1kNLq2m2ZdJyXu+DRj9o8IsrN0sxqH/6JoKaup
+xF3yyjAoLLgAVhKlK8L0dpR1NpTtAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRybjiH3zuVFSGkpdM74Vkv+tcRGzAN
+BgkqhkiG9w0BAQsFAAOCAQEAif9DiyAsBpT1Xpx9jOowhrTmjkUI60PmYaw1u93s
+zahUJxRTD1gvb55H+oYPY4BBRWOQytt06wNgJIz2B2YpgCLX3NC4o0z6qSZH+KoD
+idOS7+jcvMqthknp3l6I8NhslDf0Siru/cZ2ChUCs2XOltDNuarnVsT3Af962+ry
+CJlLQfHS25/BLpEBWirdlGGY4KX0rnTGEaPV1etBfQGWa6QwZNNa9Yp6k58XEv15
+rFhKCvPtz0JPRKu5Aq+1kskYPmP4usYENENMk9U33Alk2AGngvJFBBwteBvBtU+m
+iRb9ZVaR9Dm61VzC/PcTw/33QasrqskbAxgtOLaHGIlbRg==
 -----END CERTIFICATE-----

integration/fixtures/client-clientusage.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIECDCCAvCgAwIBAgIUHasLsGp67zGAnqDB8rbfeUk+BfcwDQYJKoZIhvcNAQEL
+BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMTAzMDUxMjEwMDBaFw0zMTAzMDMxMjEw
+MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
+BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
+ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQChWV+pXjvkSC9wOdT9tKM2wP9gJpp7BIG9EmG8hIZMWl2b
+vAyOXc0aNqYoXiDpYUem1klC6Xs5s7INbgmJdP0q8w7XW1kZvOfSX9ODs1LmN4e7
+irnhmgsUdB1x5jnzqeVb0katCnbZr+U0Qr4ROYhsCa95e0kd34qeGm+3uUiqybKa
+02WX3BT8HcT/ulq7tp05aRIQNLyjc4AQoRoRFKMj71hPgvYd7QKOXSy28BxjHlKQ
+dy3D9A0PcLW2siufJh4DwFnwsCyXYjyBcNVd3AHa/ncKtgYWAbJi1DozY0cYur2o
+OlcWtqe+KJDFQc+eEvmmBNWu/cnI/mFttT0RK/HvAgMBAAGjgZIwgY8wDgYDVR0P
+AQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD
+VR0OBBYEFBulc8jtesBMtTj87LSadwA5awR/MB8GA1UdIwQYMBaAFHJuOIffO5UV
+IaSl0zvhWS/61xEbMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG
+9w0BAQsFAAOCAQEAnch6f6Aw7eh+EvtpigmaKFw6sTVcaKH3TcMREoWUYcCrMrRt
+YD3UO3S/lsxmfWdbO3VtOXX3SaNlDSGsz6OjgEcCx4MQ46WVMtORkZrtov21YJMp
+tekv/+kj5PrPvuSVBQZwID1aYS1+/Q+HNPN2PMfXroWKQ9Co3XCYYje0yLDoQEEB
+33KJb9+3Eg232iHflVPBws+LqQ523bkYIgJW/Aw2dnWpO1KCRTqroCZRco9dtFgU
+eK023coB40DbNVCO7kUuuzTvezHLuvFhOTTT49R6Rv7ad992h2Hz1uHr7MLsajAm
+yKV6tvMbDb7rClK+ySpaDDi2XSRGDLiyAQiKLg==
+-----END CERTIFICATE-----

integration/fixtures/client-clientusage.key.insecure

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAoVlfqV475EgvcDnU/bSjNsD/YCaaewSBvRJhvISGTFpdm7wM
+jl3NGjamKF4g6WFHptZJQul7ObOyDW4JiXT9KvMO11tZGbzn0l/Tg7NS5jeHu4q5
+4ZoLFHQdceY586nlW9JGrQp22a/lNEK+ETmIbAmveXtJHd+Knhpvt7lIqsmymtNl
+l9wU/B3E/7pau7adOWkSEDS8o3OAEKEaERSjI+9YT4L2He0Cjl0stvAcYx5SkHct
+w/QND3C1trIrnyYeA8BZ8LAsl2I8gXDVXdwB2v53CrYGFgGyYtQ6M2NHGLq9qDpX
+FranviiQxUHPnhL5pgTVrv3JyP5hbbU9ESvx7wIDAQABAoIBAQCXECVXXmn2pnr7
+uLmou2ogRnwS2rHBwYtyqPYm2XEfpW+E8oBS/pGcHFRe8RohRzodgv1ej1kWwh5P
+Ipn9PzIU9zILAXSfe1UUizFuWgOglZcYSJ8WEPKUuM4kqKfTcVrTKEGRm32A/IU8
+88weNl56wGqw83OWa4fN1PSJ8AiQFQC+y4vvaD7YMU0r2hYqwE7zckarNRgMaEH6
+qFBiT42D6L7s3b+wqIuvCKN7CYOmJyJAh89ybOYnVieypp6Wjkd0akbY+I2TEej0
+SW3o9ooZ+5UJOmjVNUsjtJjNz+6IiNGvoS0kZpPMdv2/F6Bfa5kPIWBQ5KMk5Liz
+9bf42JopAoGBANJogMyZN3Y5MYB4S0MtDjmmWAY13QyEX6oFmic6EuB5sBcTaBjo
+kLQkso9QcU8nxKvw9feBMDCpacpBPf14f2UbV+DyskRZZlJgITX3MRYm98DHiOsD
+kL8RPU5aqn0FZJHnlmX/EsjydgISLimxFPt84muTE4I27C2Qjxkyiuv7AoGBAMRP
+hs8rpK6DgWAQkExYHPCPthJcBdds3+Y8UN7xwlLGH9oDSAio7Khdzs1U4narSlQ4
+UYUfQz49MmkIk1yvxSQ60nC+JLsp1rtsAPSkFZHC+weiCoOZU6xERvnr+Bm9uffd
+lVLNVcIWOt6c5EvZNTavs6IcZSh4EywWmRRVlVudAoGAR/EDWPFqTTnw+wQmd6mI
+G54MqtLv6b+5FeEkfBUXLzlsQ/eWuC2MjIufofDXTUFDtaaF80Jwv7KtQUJdd7Uj
+meZnfbp9yXDn03Ka6GDEn9ZjD78pyXFGpI24cHn/oQ+e+2Q7wFQekCaWws6EiizK
+B9MDd9Sp7vPofQvYYb0uUtECgYBsed1uYRlw7W3yHXT/GrlzHJZpcrwvnBPk73No
+noLYpm43VBTb5CxRpPR/deZl2KUMAMrbGrlXjQ1sCLcVQnNXX8GlVwyI98eWbUnh
+5UGd9/Yq85mHupQH3vqxY3kHEFXQ53p59MjspMgG9v8YAoBrJY/HhpVHVYKSnDIe
+kGQl6QKBgQCuNOYTP6uH6X6G08/riIahviNEa4hTiRVAEJjNpuoNI9I9YHogNRDT
+U+01m+huaZubNf/2VSInl33Mbm+0+Wj6QHNxIxX0hytUPA5mKkE8u116ml5oHEHB
+QLEIEOvWbmGlo6f14vJtUfq8KNRYTf1/UHp0YcUF/VwD/Kv5K1kXXg==
+-----END RSA PRIVATE KEY-----

integration/fixtures/gencert.json

@@ -8,6 +8,24 @@
           "client auth"
         ],
         "expiry": "87600h"
+    },
+    "profiles": {
+      "client-only": {
+        "usages": [
+          "signing",
+          "key encipherment",
+          "client auth"
+        ],
+        "expiry": "87600h"
+      },
+      "server-only": {
+        "usages": [
+          "signing",
+          "key encipherment",
+          "server auth"
+        ],
+        "expiry": "87600h"
+      }
     }
   }
 }

integration/fixtures/gencerts.sh

@@ -25,6 +25,26 @@ cfssl gencert \
 mv server.pem server.crt
 mv server-key.pem server.key.insecure
 
+#generates certificate that only has the 'server auth' usage
+cfssl gencert \
+  --ca ./ca.crt \
+  --ca-key ./ca-key.pem \
+  --config ./gencert.json \
+  --profile=server-only \
+  ./server-ca-csr.json | cfssljson --bare ./server-serverusage
+mv server-serverusage.pem server-serverusage.crt
+mv server-serverusage-key.pem server-serverusage.key.insecure
+
+#generates certificate that only has the 'client auth' usage
+cfssl gencert \
+  --ca ./ca.crt \
+  --ca-key ./ca-key.pem \
+  --config ./gencert.json \
+  --profile=client-only \
+  ./server-ca-csr.json | cfssljson --bare ./client-clientusage
+mv client-clientusage.pem client-clientusage.crt
+mv client-clientusage-key.pem client-clientusage.key.insecure
+
 # generate DNS: localhost, IP: 127.0.0.1, CN: example.com certificates (ECDSA)
 cfssl gencert \
   --ca ./ca.crt \

integration/fixtures/server-ecdsa.crt

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDRzCCAi+gAwIBAgIUKgQJ/CMaFxc4JcwwGyiT/7KpedIwDQYJKoZIhvcNAQEL
+MIIDRzCCAi+gAwIBAgIUT0Q49V3gY0SIVwClKHdjBDzQJqgwDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMTAzMDUxMjEwMDBaFw0zMTAzMDMxMjEw
 MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjO
-PQMBBwNCAARXbc8naiFZ3Y2LujrnDCScVNRks/TR+aXPmnuPGjDxbuHxSSbC8Q2z
-iTvCkgsIcsifmUIEQcI4v3Kbkj3qMF1so4GcMIGZMA4GA1UdDwEB/wQEAwIFoDAd
+PQMBBwNCAAS8uyoabFyLjBmx5tmFNf8z8e1MvNA0sMGk931CyQ2vSppNrxtU6Ogq
+wc6iy6o9H5FPOnWqajJ13n75qAkGTOZGo4GcMIGZMA4GA1UdDwEB/wQEAwIFoDAd
 BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
-HQ4EFgQU3z1DifT82BfoU5DfMe08meeYmSUwHwYDVR0jBBgwFoAUZQe+r42mchS6
-xFBpug0H8o5jej4wGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3
-DQEBCwUAA4IBAQAE3bhZcJuGrnMGMgebCFMuAXvoF9twYIHXpxNOg6u0HTIWOsMB
-njEJW/rfZFE/RAJ6JdOMNE2bq2LbJ8dUA25PX3uz6V4omm9B3EvEG9Hh3J+C77XQ
-P+ofiUd+j06SdewoxrmmQmjZZdotpFUQG3EEncs+v94jsamwGNLdq4yWDjFdmyuC
-hqzSkD48aGqP2Q93wfv8uIiCEmJS1vITTm2LxssCLfiYGortpCx32/DWme8nUlni
-1U/pRTx8Brx00dMeruTGjCCpwb8k453oNV6u0D1LsQ9y5DuyEwmZtBEHBN1kVPro
-yYW3/b1jcmZk8W9GXqcXy16LbWmpvJmTHPsj
+HQ4EFgQU6bjNiM/mqEu/sJOD+qsH1M23iZEwHwYDVR0jBBgwFoAUcm44h987lRUh
+pKXTO+FZL/rXERswGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3
+DQEBCwUAA4IBAQCG4JmdDmJHjxncP8+p+h6b2Pd/N0fotLw5COIyu92V2XNAx7yt
+KsJk1BPJena/CxxU7Bsf0FFNtU+hmkWSUfxFiKplCausK81eVLHWzcd5A6q7vOKy
+7T2WF4jRwmU6Cgz2TFROxfGqbvUmBLoBJFUsXNYxSVyzJGQSgbDLJGAzwra7JjyY
+4t9K1W9RXmC/je+l9m0utW74YFSQ0fOb6Z3ZCLkSnxHy192FYeJ2ViRIUBYOltde
+B8OYZ18y1woWzkqfzoMut5Tc1jHg8/Apa3USXhj1ThaTj0Dh6tn9HCVez8QWl0dE
+TSsbwStelXSjLWQFm3Mw/xAKCt/IaIswjz3t
 -----END CERTIFICATE-----

integration/fixtures/server-ecdsa.key.insecure

@@ -1,5 +1,5 @@
 -----BEGIN EC PRIVATE KEY-----
-MHcCAQEEIK3K2gimOw2P0pZ4soFAopriuORuqpRptllFXNRhCRV0oAoGCCqGSM49
-AwEHoUQDQgAEV23PJ2ohWd2Ni7o65wwknFTUZLP00fmlz5p7jxow8W7h8UkmwvEN
-s4k7wpILCHLIn5lCBEHCOL9ym5I96jBdbA==
+MHcCAQEEIGn1PyiUdUgft96jNYtkLvv1dvRVJPmxcReM8p9qICmLoAoGCCqGSM49
+AwEHoUQDQgAEvLsqGmxci4wZsebZhTX/M/HtTLzQNLDBpPd9QskNr0qaTa8bVOjo
+KsHOosuqPR+RTzp1qmoydd5++agJBkzmRg==
 -----END EC PRIVATE KEY-----

integration/fixtures/server-ip.crt

@@ -1,24 +1,24 @@
 -----BEGIN CERTIFICATE-----
-MIIEBzCCAu+gAwIBAgIUSvxuG1lgImYpnaK4sPaCiMAd0lgwDQYJKoZIhvcNAQEL
+MIIEBzCCAu+gAwIBAgIUNBF2hQTCSrLwdqexC1KaDUF4658wDQYJKoZIhvcNAQEL
 BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
 Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl
-Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xOTEwMDgyMTE5MDBaFw0yOTEwMDUyMTE5
+Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMTAzMDUxMjEwMDBaFw0zMTAzMDMxMjEw
 MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE
 BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT
 ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQC7mJOiyqWfmNM5ptQZ22plotVfgoBf9fHTzMw/ap2Vl0/0
-4V3GEyYCdPt6V87GWzjBSO9GAmlISBQQybMieZTaTm8KKW2066iJDKseBCv9m4nS
-mHv0oDqp3SHsZQ2xHis4lbi7ws2thdqpmjw4Dv96SUiCJUjhcBX4kBMRcOGgk1RF
-ENIOInTSKlAiwNF1NSnhj8wMNw7mjw90jpAGAuPuuiQ7+AYHJBJqtT9mRikR8ppw
-isjEE6kslCCg2RC45AiF4LXNp7A7Xwm6P34XJ6T9PJUh/r3pa0xHRuI2zQLaW8Z/
-b6NYkUGMbHR7AY/+2JzOfnnnQcSB8EYC9bHadvHnAgMBAAGjgZEwgY4wDgYDVR0P
+A4IBDwAwggEKAoIBAQDHVlmvOxWnBbew+27gvWVYppaz9sGC4BfhlPoBJrHbfJrs
+FIUi0iFsJjDSard+ezTJC/Cn0KtQUcJYY+Ln827pn/ORRKpV4jGX8WxcVGU45qqO
+namYvwtOTbXYqVn63vM+SiLWlBcyHgwYfDgklS1fKLE/31Ecfjcsy86kYwncbN4F
+26S2ol/Ey844T2tOCZzG1R+oWMHe0/wwfLhEsgFv51GuGENWwvEjepQOSNhZvdKf
+BAi7LyfQJ+/RE9xfweO7l0FTR68BBppras9OAChZV8Vq3DPy+VjCNrPDiDJTyL7K
+f7ph3pd8h4kmLalRtp82j/9q8azAFGgIE0aQalyTAgMBAAGjgZEwgY4wDgYDVR0P
 AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
-Af8EAjAAMB0GA1UdDgQWBBSPaFA2Jh7s/IJN/Yw/QFFR4pO3nDAfBgNVHSMEGDAW
-gBRlB76vjaZyFLrEUGm6DQfyjmN6PjAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3
-DQEBCwUAA4IBAQAO2EnUXDlZAzOJLmkzQQF/d88PjvzspFtBfj/jCGzK6bpjeZwq
-oM1fQOkjuFeNvVLA3WHVT0XEpZEM8lwAr/YwnBWMFlNd3Vb2Cho5VaQq0nVfhYoB
-tpzoWcf0Qx4cALesQZ3y2EnXePpzky1R4MfHqulYrmZKSBQsERob/7YgSBk+ucV9
-OHLzYxm4OvYvDoR54REq+vgZ3ohoDmBrNNv9OmUHLIrUi+nBpBgnww85Dc7cKB27
-EEKxqIfCNTeHSemvzfK/1M6manQX6eyGe48nOwQMV/ocfY6SeA7RABT0l/UsbeMp
-g/b2RU+liZ3e8FziW4/1VTt1pmFAN/2hnb0v
+Af8EAjAAMB0GA1UdDgQWBBTfkO3xr7d5Kfte7ccj3tdt/WbIjDAfBgNVHSMEGDAW
+gBRybjiH3zuVFSGkpdM74Vkv+tcRGzAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3
+DQEBCwUAA4IBAQAGrK7ttOzLDVUPgQRizKpwNtlV/MXQSBSPF805bvMtPT90lq5c
+HvTqlqP99JV0zQn2h+yrhfB2F5908KuoWbw3I5lxoB0navkaIql8lz/jzr1dcS3Y
+wOpx6h79+htMQnoKLHFPUSzCTUPymXXvkMk5PRTfe3dXk4a7Sw/Y2xtH8mFtep9Q
+MuVJJhTIUmKf6X1CALcoh5cbCh7ChEIhLgZcK9o2s2xZQyWxp6Ms2uNQOHyiaO7y
+sxgDYxuA/xmNL25VhBO0eryE9mJMU2awtHwfxE5Au5OHxJQbesFIw21qd6AMHqYl
+AbgFRzebLA93fArRBpxrlXnyof6A4OHaNVT+
 -----END CERTIFICATE-----

integration/fixtures/server-ip.key.insecure

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAu5iTosqln5jTOabUGdtqZaLVX4KAX/Xx08zMP2qdlZdP9OFd
-xhMmAnT7elfOxls4wUjvRgJpSEgUEMmzInmU2k5vCilttOuoiQyrHgQr/ZuJ0ph7
-9KA6qd0h7GUNsR4rOJW4u8LNrYXaqZo8OA7/eklIgiVI4XAV+JATEXDhoJNURRDS
-DiJ00ipQIsDRdTUp4Y/MDDcO5o8PdI6QBgLj7rokO/gGByQSarU/ZkYpEfKacIrI
-xBOpLJQgoNkQuOQIheC1zaewO18Juj9+Fyek/TyVIf696WtMR0biNs0C2lvGf2+j
-WJFBjGx0ewGP/ticzn5550HEgfBGAvWx2nbx5wIDAQABAoIBAB0jBpM7TFwsfWov
-6jOV68Gbd+6cs1m0NnpCDdsvsQgh904+jrUMFlQ9XS3UY45Vbsw+isNh7n5Gi69L
-1KHfJmp90itO4fY+v++BYzaHSVnbhZ2LB32oQVROv00bKPRAjk/8mTO4fv+bkanU
-BdRjJ/UTWsq0BczV/uObZQrJcJHi6+sAMYw4b/kxzTALd+UuvmOP7Z/NoWW6x8Mm
-ahHgqaMwA0O1f4DsdKYnSUVMF9DNGsxKCUYSYR6RH93Bq/Eo0q1U2egmLIMcTVW9
-7QSWsJoZuXlzkq7Hb7mxGdppa6kSzA/VM26qPNE9Cjg4tCMu1RJSfgkcnv27Y8vZ
-fZSq3zkCgYEA68VjIqG6sj43SZSvD+Z+Dfuzc+lO4YBSI0Yru8B4ZZq0vfTVQdM/
-uf0Bpk/nMbqec/kfcPMHP8zznLe8rcmfZXNQFIaajOb6rzWhCRSgbX98MeGnUe/y
-9sG+zFSRrAPDaVRJZwSYILs6o6Hz4o6DBCvr8iKFfm26SLB7hIjwx8UCgYEAy7EL
-dIMdsGDzfmxAYqad3oy/N1KVp96zfdnHEiIC0oiXz3YfI7YLFj54yXxx5rHR2/AK
-wOo7b90Rc8R0PgtKedKrz5p/E0Bz723ToTxHjsqgVRZqYaEKUOp8wR2t2DJOF9b9
-0C/qp6iUy0IOTBYyu3BCMV0aB5kRW62jXJIsQbsCgYB6uO7mOurUFsBug38wNpjM
-rIR3RCz0Afg/NipTe1bwBDwqWEOdFNmp9QEj0ZmU7//EfBsajtXqJsNzgswqZbWb
-eA9p77qItz4rby3YbS0oceByknOmmdCNEsI+15JPyFGyBNaEUgbhmrNmM0mgVu/p
-fvc8vS1hZro9VeelUCaMxQKBgFDgnXHH1fQAqu4ZwX7qNWj2bb5jtjSPgqmH3Tlf
-88rwnYasmjStxb0xVPh7xyYYmQFBUKPE3ZDPMGzNJnK0PQAeHEY0TByyzNXWv98X
-djpGTl86pUbakKQMVzi+thZP8x4YKXOOcxfbIimKsu6XKdGvAzlihEFcD75dNa4+
-BACdAoGBAJevnrC7M/KyDDGW3ci4sFcn7MxRGqLBulwGoCuM+zecbG7NBvDynoaH
-NRGpASiboRJyCEoIQivvkZf+K7L/oB4bL/ThF2ZpJUe471tq0444xnXdHRDLG0Dw
-OnBl27e3iAiUctqR51ufXKOUaNEf4gcsS9duELMPBxM70GE2Q/2r
+MIIEpAIBAAKCAQEAx1ZZrzsVpwW3sPtu4L1lWKaWs/bBguAX4ZT6ASax23ya7BSF
+ItIhbCYw0mq3fns0yQvwp9CrUFHCWGPi5/Nu6Z/zkUSqVeIxl/FsXFRlOOaqjp2p
+mL8LTk212KlZ+t7zPkoi1pQXMh4MGHw4JJUtXyixP99RHH43LMvOpGMJ3GzeBduk
+tqJfxMvOOE9rTgmcxtUfqFjB3tP8MHy4RLIBb+dRrhhDVsLxI3qUDkjYWb3SnwQI
+uy8n0Cfv0RPcX8Hju5dBU0evAQaaa2rPTgAoWVfFatwz8vlYwjazw4gyU8i+yn+6
+Yd6XfIeJJi2pUbafNo//avGswBRoCBNGkGpckwIDAQABAoIBAAS4dsc/jvO1nvQC
+AE4yLgQ7bbY1Ub/XrrkY3hLI581a1hBhLAX3E/OLs/xHqrDEGivorHpM5sGwLfoJ
+44W6rhW6Q/pctevyv1npzbciCIOgcsmN0kZbv9jK3lOTLx5RyVDgUJLkTuhQ7dhm
+mK3FGp32SLxKfZE/K+9TpEEgV0tw/dcesRuIhSq+ccS4ti04jKxvOaRM/c3d3eUf
+iqQTOuBcEIR5+nDljAXps2c1PHb5sEvVs6mbxa8/8TSGq5QGybm7V410KbVbry9t
+vC9vxq7qL+2ftGdoknPqJSD1+gepzdHhPS5J7PcstxwfzI3NMoAu09GN+HpygP2U
+bNq9FwECgYEA8nvuaQAOVfu2HuxnkIKjW4qfNSRt0EketwjTTGvfXJAF1njysiuA
+ro64IXIDVZTL/ppRwmdInuXewsjWNFz61L58CZ2+7vcEhGSIjCXCkzhJc0uV70Ut
+fqd1P5KLwjrqYe11AsmK9s2Ue5a/kGIReWhYYqhqB/wbVIPts7PfQ8sCgYEA0nK/
+ApqZM3lQUmc1O3cn6/WhHreba9XDKkUdlXop6OanRlW5ihjJXbjDjNovyqbmEnKN
+aMAzMAEcPCFVZERd3MI1ZcNv0PFdtS76vQaY8bdYaJYZEVx7DNQPIy8nfa6rUGEn
+5y2WY80Fz2az7HdGFmcSAPxL7UYexvdgjbiYAVkCgYEA5OTn4GYVIkVBXV97Q4aN
+/dOVBe0lXAAp5k2GaBVL+2xYlmQFdPprtlsypR+i1h5nkibKFuC4RIZpCSXcTgGX
+JUvKeqlVmu3CbdcYrnLWgXIYo6UuG3cJww0AOMp08xv6NAaa9c6aRu84wpFCs2Bf
+bmN5S2f+7xqkEduXfpLEppECgYB4Jq0pZmy7d7LFKUm6JsCzNi0EJZ3lxkjEFGvc
+kL/myfGM9ZqV3qrxCHEVNOj+UaWfuKlFuh4/dRLSvdFMCsBwLq1f6WIor/VpYWYk
+j+S4dI5UQAYV5HAYleYCl4R7fEMxBBdNJLjtR/veOuvUwRBR8AzWZTVQRa2CuW/1
+2gNnGQKBgQDE8AFhHkx4RWcgMBFyxok4LgA498AxL5Sa0rJqbc2rvszbmR5kyiGP
+4vCHfGejsxmVgAclH+5EvCvKuptniSPrry7n4PVVJAb176Q/RQgfjejy8Pohlfa/
+RsB21+WKAF+uHO0PRN1kkN2zpUPeu1+ZKxcEfnwZI1WDr4ggJbQYIQ==
 -----END RSA PRIVATE KEY-----