Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

This PR adds basic support for connecting to servers requiring a client certificate, aka mTLS.
Some restrictions for now (all documented):

• only p12 and pfx formats
• key, cert and ca cert must all be present
• encryption is NOT supported ( because I couldn't find a go module to decrypt all formats without weird error messages that'd be difficult to debug for enduser

How to test?

I am planning on a PR against the pangolin repo too with similar contents, but first, newt :)
(This was tested only on macos so far)

Positive test

1. Have a pangolin deployment
2. Generate custom certs. If you want an example, check self-signed-certs-for-mtls.sh
3. Modify a pangolin server's Traefik dynamic_config.yaml by adding the following

http:
  routers:
    next-router:
     # ...
      tls:
        certResolver: letsencrypt
        options: mtlsConfig
    api-router:
      # ...
      tls:
        certResolver: letsencrypt
        options: mtlsConfig
    ws-router:
      # ...
      tls:
        certResolver: letsencrypt
        options: mtlsConfig

tls:
  options:
      mtlsConfig:
          clientAuth:
              clientAuthType: RequireAndVerifyClientCert
              caFiles:
                  - |
                      -----BEGIN CERTIFICATE-----
                      .... <content of the ca.cert>
                      -----END CERTIFICATE-----

1. Add the generated client cert, eg alice-at-example-com.eng.12 to your client

• On a mac
  1. double click, import to KeyChain, using the password. (You could also just import the non-encrypted version)
  2. Right click the imported item, Get Info
  3. Open Trust
  4. Set SSL to Always Trust
• (Sry, haven't tested this on Linux or Windows, so can't describe )

1. Visit your admin pangolin portal using a browser supporting mTLS, and select the proposed cert.
2. Create a new Site, and copy the newt cli command
3. Start newt with the copied command, with the extra arg: --tls-client-cert=./certs/clients/alice-at-example-com.p12
4. Verify both in terminal and both in pangolin admin that the site is connected

Negative test

1. Same as above but run newt without the --tls-client-cert=... arg.
2. Verify error in terminal, explaining TLS connectivity issue.