Ignore custom_tls client_cert, client_key are not always required for use with for example an AWS RDS cert

[david-heward-unmind]

Hi there,

I believe client_cert and client_key are, in fact, not required and, in many cases, should be ignored. Therefore, I'm wondering if they are incorrectly configured and we could make them optional in both the provider and the go code?

Current behaviour

Forces you to set a value.

terraform-provider-mysql/mysql/provider.go

Lines 362 to 371 in 71dfdd0

	clientCert := make([]tls.Certificate, 0, 1)
	var certs tls.Certificate
	if strings.HasPrefix(customTLS.ClientCert, "-----BEGIN") {
	certs, err = tls.X509KeyPair([]byte(customTLS.ClientCert), []byte(customTLS.ClientKey))
	} else {
	certs, err = tls.LoadX509KeyPair(customTLS.ClientCert, customTLS.ClientKey)
	}
	if err != nil {
	return nil, diag.Errorf("error loading keypair: %v", err)
	}

Where something like this is all thats required for referencing of a custom CA.

rootCertPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("/path/ca-cert.pem")
    if err != nil {
       log.Fatal(err)
    }
    if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
       log.Fatal("Failed to append PEM.")
    }
    mysql.RegisterTLSConfig("custom", &tls.Config{
                             ServerName: "qcaurora.cb556lynvxio.us-east-1.rds.amazonaws.com",
                             RootCAs: rootCertPool,
                            })
    db, err := sql.Open("mysql", "user:pass@tcp(qcrds.example.com:3306)/databasename?tls=custom")

[petoju]

Therefore, I'm wondering if they are incorrectly configured and we could make them optional in both the provider and the go code?

Yes, that is possible - but it would have to be correctly handled in code and no one has needed it so far.
Once someone needs it, they can send a PR (or if I happen to need it, I will send a PR) and add this possibility.

[david-heward-unmind]

Therefore, I'm wondering if they are incorrectly configured and we could make them optional in both the provider and the go code?

Yes, that is possible - but it would have to be correctly handled in code and no one has needed it so far. Once someone needs it, they can send a PR (or if I happen to need it, I will send a PR) and add this possibility.

I'll submit something this week 👍

[davehewy]

Raised #182 today 👍

[david-heward-unmind]

@petoju I'm just doing some validation this morning. Then we can close this issue off.

[davehewy]

@petoju I just opened #183 which slightly refactors my previous modification to cert pool behaviour.