all: Validate root CA certificates are CA certs

Reject non-CA (leaf) certificates configured as root CAs to prevent
misconfiguration where a server leaf certificate is set as a root CA.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: vlasebian

pkg/config/tlsconfig/config.go

@@ -16,9 +16,11 @@
 package tlsconfig
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/pem"
 	"os"
 	"strings"
 	"sync/atomic"
@@ -46,6 +48,14 @@ var (
 	errMissingACMEDir         = errors.Define("missing_acme_dir", "missing ACME storage directory")
 	errMissingACMEEndpoint    = errors.Define("missing_acme_endpoint", "missing ACME endpoint")
 	errMissingACMEDefaultHost = errors.Define("missing_acme_default_host", "missing ACME default host")
+	errParsePEM               = errors.DefineInvalidArgument("parse_pem", "parse PEM")
+	errUnexpectedPEMType      = errors.DefineInvalidArgument(
+		"unexpected_pem_type", "unexpected PEM block of type `{pem_type}`, expected CERTIFICATE",
+	)
+	errParseCertificate = errors.DefineInvalidArgument("parse_certificate", "parse certificate")
+	errNotCACertificate = errors.DefineInvalidArgument(
+		"not_ca_certificate", "certificate with subject `{subject}` is not a CA certificate",
+	)
 )
 
 // Initialize initializes the autocert manager for the ACME configuration.
@@ -190,17 +200,53 @@ func (c Client) ApplyTo(tlsConfig *tls.Config) error {
 	}
 
 	if len(rootCABytes) > 0 {
+		certs, err := parseAndValidateCACerts(rootCABytes)
+		if err != nil {
+			return err
+		}
+
 		if tlsConfig.RootCAs == nil {
 			if tlsConfig.RootCAs, err = x509.SystemCertPool(); err != nil {
 				tlsConfig.RootCAs = x509.NewCertPool()
 			}
 		}
-		tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes)
+
+		for _, cert := range certs {
+			tlsConfig.RootCAs.AddCert(cert)
+		}
 	}
 	tlsConfig.InsecureSkipVerify = c.InsecureSkipVerify
 	return nil
 }
 
+func parseAndValidateCACerts(pemBytes []byte) ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	for {
+		pemBytes = bytes.TrimSpace(pemBytes)
+		if len(pemBytes) == 0 {
+			break
+		}
+		block, rest := pem.Decode(pemBytes)
+		if block == nil {
+			return nil, errParsePEM.New()
+		}
+		if block.Type != "CERTIFICATE" {
+			return nil, errUnexpectedPEMType.WithAttributes("pem_type", block.Type)
+		}
+		pemBytes = rest
+
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, errParseCertificate.WithCause(err)
+		}
+		if !cert.IsCA {
+			return nil, errNotCACertificate.WithAttributes("subject", cert.Subject.String())
+		}
+		certs = append(certs, cert)
+	}
+	return certs, nil
+}
+
 func readCert(fileReader FileReader, certFile, keyFile string) (*tls.Certificate, error) {
 	readFile := os.ReadFile
 	if fileReader != nil {

pkg/config/tlsconfig/config_test.go

@@ -42,7 +42,7 @@ func (m mockFileReader) ReadFile(name string) ([]byte, error) {
 	return nil, fmt.Errorf("not found")
 }
 
-func genCert() (certPEM []byte, keyPEM []byte) {
+func genCertWithOptions(isCA bool) (certPEM []byte, keyPEM []byte) {
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		panic(err)
@@ -60,10 +60,13 @@ func genCert() (certPEM []byte, keyPEM []byte) {
 		},
 		NotBefore:             now,
 		NotAfter:              now.Add(time.Hour),
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		BasicConstraintsValid: true,
-		IsCA:                  true,
+		IsCA:                  isCA,
+	}
+	if isCA {
+		cert.KeyUsage |= x509.KeyUsageCertSign
 	}
 	certBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, key.Public(), key)
 	if err != nil {
@@ -80,6 +83,10 @@ func genCert() (certPEM []byte, keyPEM []byte) {
 		})
 }
 
+func genCert() (certPEM []byte, keyPEM []byte) {
+	return genCertWithOptions(true)
+}
+
 func TestApplyTLSClientConfig(t *testing.T) {
 	t.Parallel()
 	a := assertions.New(t)
@@ -107,6 +114,115 @@ func TestApplyTLSClientConfig(t *testing.T) {
 	})
 }
 
+func TestApplyTLSClientConfigRejectsLeafCert(t *testing.T) {
+	t.Parallel()
+	leafCert, _ := genCertWithOptions(false)
+	caCert, _ := genCertWithOptions(true)
+
+	t.Run("LeafCertificate", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"leaf.pem": leafCert,
+			},
+			RootCA: "leaf.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.NotBeNil)
+		a.So(err.Error(), should.ContainSubstring, "not a CA certificate")
+	})
+
+	t.Run("CACertificate", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"ca.pem": caCert,
+			},
+			RootCA: "ca.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.BeNil)
+		a.So(tlsConfig.RootCAs, should.NotBeNil)
+	})
+
+	t.Run("MultipleCertsOneLeaf", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		combined := append(caCert, leafCert...)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"mixed.pem": combined,
+			},
+			RootCA: "mixed.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.NotBeNil)
+		a.So(err.Error(), should.ContainSubstring, "not a CA certificate")
+	})
+
+	t.Run("MultipleCACertificates", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		caCert2, _ := genCertWithOptions(true)
+		combined := append(caCert, caCert2...)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"cas.pem": combined,
+			},
+			RootCA: "cas.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.BeNil)
+		a.So(tlsConfig.RootCAs, should.NotBeNil)
+	})
+
+	t.Run("InvalidPEM", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"bad.pem": []byte("not a pem"),
+			},
+			RootCA: "bad.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.NotBeNil)
+		a.So(err.Error(), should.ContainSubstring, "parse PEM")
+	})
+
+	t.Run("NonCertificatePEMBlock", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		_, keyPEM := genCertWithOptions(true)
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"key.pem": keyPEM,
+			},
+			RootCA: "key.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.NotBeNil)
+		a.So(err.Error(), should.ContainSubstring, "unexpected PEM block")
+	})
+
+	t.Run("TrailingNewlines", func(t *testing.T) {
+		t.Parallel()
+		a := assertions.New(t)
+		withNewlines := append(caCert, '\n', '\n', '\n')
+		tlsConfig := &tls.Config{} //nolint:gosec
+		err := (&tlsconfig.Client{
+			FileReader: mockFileReader{
+				"ca.pem": withNewlines,
+			},
+			RootCA: "ca.pem",
+		}).ApplyTo(tlsConfig)
+		a.So(err, should.BeNil)
+		a.So(tlsConfig.RootCAs, should.NotBeNil)
+	})
+}
+
 func TestApplyTLSServerAuth(t *testing.T) {
 	t.Parallel()
 	a := assertions.New(t)