Ability to connect to an endpoint that is protected by HTTP authentication and/or SSL Client Certificates

cmd/php-fpm-exporter/main.go

@@ -13,6 +13,7 @@ func main() {
 		endpoint        = kingpin.Flag("endpoint", "url for php-fpm status").Default("http://127.0.0.1:9000/status").String()
 		fcgiEndpoint    = kingpin.Flag("fastcgi", "fastcgi url. If this is set, fastcgi will be used instead of HTTP").String()
 		metricsEndpoint = kingpin.Flag("web.telemetry-path", "Path under which to expose metrics. Cannot be /").Default("/metrics").String()
+		authConfigFile  = kingpin.Flag("auth.config", "Configuration file with authentication information, i.e. HTTP Auth and TLS client certificates").Default("").String()
 	)
 
 	kingpin.HelpFlag.Short('h')
@@ -29,6 +30,7 @@ func main() {
 		exporter.SetFastcgi(*fcgiEndpoint),
 		exporter.SetLogger(logger),
 		exporter.SetMetricsEndpoint(*metricsEndpoint),
+		exporter.SetAuthConfig(*authConfigFile),
 	)
 
 	if err != nil {

collector.go

@@ -1,6 +1,7 @@
 package exporter
 
 import (
+	"crypto/tls"
 	"io/ioutil"
 	"net/http"
 	"net/url"
@@ -112,7 +113,7 @@ func getDataFastcgi(u *url.URL) ([]byte, error) {
 	return body, nil
 }
 
-func getDataHTTP(u *url.URL) ([]byte, error) {
+func (c *collector) getDataHTTP(u *url.URL) ([]byte, error) {
 	req := http.Request{
 		Method:     "GET",
 		URL:        u,
@@ -123,7 +124,30 @@ func getDataHTTP(u *url.URL) ([]byte, error) {
 		Host:       u.Host,
 	}
 
-	resp, err := http.DefaultClient.Do(&req)
+	var client *http.Client
+	if c.exporter.authConfig.ClientCert != "" {
+		cert, err := tls.LoadX509KeyPair(c.exporter.authConfig.ClientCert, c.exporter.authConfig.ClientKey)
+		if err != nil {
+			return nil, errors.Wrap(err, "Could not load cert and/or key")
+		}
+
+		client = &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					Certificates:       []tls.Certificate{cert},
+					InsecureSkipVerify: c.exporter.authConfig.AllowInsecureServerCert,
+				},
+			},
+		}
+	} else {
+		client = http.DefaultClient
+	}
+
+	if c.exporter.authConfig.AuthUser != "" {
+		req.SetBasicAuth(c.exporter.authConfig.AuthUser, c.exporter.authConfig.AuthPass)
+	}
+
+	resp, err := client.Do(&req)
 	if err != nil {
 		return nil, errors.Wrap(err, "HTTP request failed")
 	}
@@ -152,7 +176,7 @@ func (c *collector) Collect(ch chan<- prometheus.Metric) {
 	if c.exporter.fcgiEndpoint != nil && c.exporter.fcgiEndpoint.String() != "" {
 		body, err = getDataFastcgi(c.exporter.fcgiEndpoint)
 	} else {
-		body, err = getDataHTTP(c.exporter.endpoint)
+		body, err = c.getDataHTTP(c.exporter.endpoint)
 	}
 
 	if err != nil {

exporter.go

@@ -2,6 +2,7 @@ package exporter
 
 import (
 	"context"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -10,20 +11,32 @@ import (
 	"syscall"
 	"time"
 
+	"gopkg.in/yaml.v2"
+
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"go.uber.org/zap"
 	"golang.org/x/sync/errgroup"
 )
 
+// AuthenticationConfiguration is the in-memory, decoded representation of the authentication configuration file
+type AuthenticationConfiguration struct {
+	ClientCert              string `yaml:"clientcert"`
+	ClientKey               string `yaml:"clientkey"`
+	AllowInsecureServerCert bool   `yaml:"allow_insecure_server_cert"`
+	AuthUser                string `yaml:"authuser"`
+	AuthPass                string `yaml:"authpass"`
+}
+
 // Exporter handles serving the metrics
 type Exporter struct {
 	addr            string
 	endpoint        *url.URL
 	fcgiEndpoint    *url.URL
 	logger          *zap.Logger
 	metricsEndpoint string
+	authConfig      AuthenticationConfiguration
 }
 
 // OptionsFunc is a function passed to new for setting options on a new Exporter.
@@ -124,6 +137,38 @@ func SetMetricsEndpoint(path string) func(*Exporter) error {
 	}
 }
 
+//SetAuthConfig sets the authentication configuration for connecting to the endpoint(s)
+//Generally only used when creating a new Exporter.
+func SetAuthConfig(authConfigFile string) func(*Exporter) error {
+	return func(e *Exporter) error {
+		if authConfigFile != "" {
+			authConfig, err := readAuthConfig(authConfigFile)
+			if err != nil {
+				return errors.Wrap(err, "failed to read authentication configuration file")
+			}
+			e.authConfig = authConfig
+		}
+		return nil
+	}
+}
+
+//readAuthConfig reads authentication configuration from auth.config file passed as command-line parameter
+func readAuthConfig(authConfigFile string) (AuthenticationConfiguration, error) {
+
+	var authConfig AuthenticationConfiguration
+
+	yamlString, err := ioutil.ReadFile(authConfigFile)
+	if err != nil {
+		return authConfig, errors.Wrap(err, "failed to read authentication configuration file")
+	}
+
+	err = yaml.Unmarshal(yamlString, &authConfig)
+	if err != nil {
+		return authConfig, errors.Wrap(err, "failed to unmarshal authentication configuration file")
+	}
+	return authConfig, nil
+}
+
 var healthzOK = []byte("ok\n")
 
 func (e *Exporter) healthz(w http.ResponseWriter, r *http.Request) {

go.mod

@@ -20,4 +20,5 @@ require (
 	golang.org/x/net v0.0.0-20190415214537-1da14a5a36f2 // indirect
 	golang.org/x/sync v0.0.0-20170418210838-de49d9dcd27d
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
+	gopkg.in/yaml.v2 v2.2.7
 )

go.sum

@@ -40,3 +40,7 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

test/README.md

@@ -5,3 +5,6 @@ This directory contains simple configurations for testing.
 `nginx -c `pwd`/nginx.conf`
 
 `php-fpm-exporter`
+
+`php-fpm-exporter --auth.config ./php-fpm.example.yml`
+

test/README.ssl

@@ -0,0 +1,25 @@
+#From here: https://www.makethenmakeinstall.com/2014/05/ssl-client-authentication-step-by-step/
+#and here for the crl: https://blog.didierstevens.com/2013/05/08/howto-make-your-own-cert-and-revocation-list-with-openssl/
+
+#generate CA
+openssl req -newkey rsa:4096 -keyform PEM -keyout ca.key -x509 -days 3650 -outform PEM -out ca.cer
+
+#generate CRL
+mkdir demoCA
+touch demoCA/index.txt
+echo 01 > demoCA/crlnumber
+openssl ca -gencrl -keyfile ca.key -cert ca.cer -out ca.crl.pem
+
+#generate server cert
+openssl genrsa -out server.key 4096
+openssl req -new -key server.key -out server.req -sha256
+openssl x509 -req -in server.req -CA ca.cer -CAkey ca.key -set_serial 100 -extensions server -days 1460 -outform PEM -out server.cer -sha256
+rm server.req
+
+#generate client cert
+openssl genrsa -out client.key 4096
+openssl req -new -key client.key -out client.req
+openssl x509 -req -in client.req -CA ca.cer -CAkey ca.key -set_serial 101 -extensions client -days 365 -outform PEM -out client.cer
+openssl pkcs12 -export -inkey client.key -in client.cer -out client.p12
+rm client.req
+

test/ca.cer

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFhTCCA22gAwIBAgIUG+HrpsOC/pNAAkoJ9vVbgh6pt38wDQYJKoZIhvcNAQEL
+BQAwUjELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCQ0EwHhcNMTkxMjI1
+MTc1OTMyWhcNMjkxMjIyMTc1OTMyWjBSMQswCQYDVQQGEwJBVTETMBEGA1UECAwK
+U29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQsw
+CQYDVQQDDAJDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANUuat12
+CTjUNhy8fc+RV9QbV+ZYElspsqW+jH1yzhNDglnK3s5by57ywKHhJrk2ZPJWCLCV
+VJKn5huTKZ+iUXJebJ3AAu/6EJenGDQ7EP0bLa01HDbeuheRikcTiuLSHgSIR9dQ
+cOtdiYKCT6VclYOA5IAk7kD6yS4WS1zWRBF97VVZ9GMY1eCAwAVTv3W2MbgsvLHc
+i6RhGTlIdUz6KAg3u5qEA3vRq6RCuieBBPoXVQnojrcZ0OtGf1iQD7QAala3lFu0
+nsBMOU6ggBqfsfb+MqOzskqj/n2ezocYvEsKnOL5gf+OqBBsOqd1otcphxqaXXm1
+xfG8t35Re3uKuh2L1T7skAS6muK5h4wlFm9ozXKLpI5sp9WTspILNEY3SlrE8RZQ
+Yayxl6hBYkkxB8DqLRdaMwFcWadlY81aE0m4JSUUf2JWkIrkyTBd71mWkTxSXZZ/
+0YHZuK+yb7F3ewU2B+UFWmY1KGbwYRjEqeVRQjXK2PjemUpG3yUXbt3/bXaJaJit
+9V/tT4TiGL+sJqTVndbClZNJjObgyx7ZEpjO+St32LpmZysLg89dm+f8r2PemmfL
+lAdniv4AZT0lBoqh2sTNVQ6ta10o5xiOphFMqr0ISt9KJkAF2LwBOcFHfHC0dWbJ
+oVaD0OI6TowaXvQY+DIq/kv0m8wtKA2A2kbrAgMBAAGjUzBRMB0GA1UdDgQWBBTF
+d+70C+PRmF0oISaOf0jKSmhYdjAfBgNVHSMEGDAWgBTFd+70C+PRmF0oISaOf0jK
+SmhYdjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAarJLU1qHO
+8mfHxgSt9A2O/kibHqKMe8DH9/w+d9uh5bZ4hhcEcbJG0/brQuhyR4yeCIRxQvp8
+D8ugp49uAHdWBA7t9Wltqt1r2SN/pbHbRBGRElhda+qOKirZeffkckx+/WIizRS9
+wLFSGJZZ1QbLAvx/+2GSL0OOaU8yV3JVNck9zVUnplfhReu4syl0Mjg8a6OczmSF
+lf0Y930HZ2NNbaK8cNCH4STMEATc9nWA6/FV3voSS1Z+6vQezy6wRyckZbMPaW6a
+xG7wk34ysAXIaJ+Bp6WQ3B2cXczU7bbFCr+wd376Sw/Ds59f23e+uyiS8zNpNBuB
+qu+nel2yH4HTA4iyVnN9WpWrSbRQOhODFmYR4gA0QlJHfH5HLnaY78DD3RNFpa40
+vuxJnsBG5GwEOUJsjSKPkShcMgyBSKJisscTKNWkskh75DOXIIXbyLrl9JCi4Hug
+rOOPj7Zx/6nNB5yCfXLayg4kf9G5CvzreUGti4tAUq7BRaoiK9Y36mne2JrRaTxz
+cxbPTSx+Ywiw/GNLDx3cmgJcEQpM2YtZo7aHs6xja/80z3bnAJzQWNqFZ2Heh9X2
+TuCLiVQo6ClEmT4WlW4erKaWteu9RF0+QUSCLRanfayuWmoeqVGQF6516DS4hNn6
+43mVRxExxK3uapqQbS+irkxbVzPuN1Vn6Q==
+-----END CERTIFICATE-----

test/ca.crl.pem

@@ -0,0 +1,17 @@
+-----BEGIN X509 CRL-----
+MIICqzCBlAIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJBVTETMBEGA1UE
+CAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MQswCQYDVQQDDAJDQRcNMTkxMjI1MTgxMTQ4WhcNMjAwMTI0MTgxMTQ4WqAOMAww
+CgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggIBAMAemRbjUDK7P2snSNy8vn3l
+kR0zmkEb3o2hcq5qBndR5jbCtSC82dXLKBWK3bFlzJN82S4TcGh2kRXhj0n3WH4x
+BqPsfA+U2ZVBm//9B+IzvRl8jVBNLZ6uqBtht2RD2RjCkydqIyT8QDYYO5lWHBxc
+Ff1WHvA+sCb8OvuYfi5iJ2wuQRMg+Dxj3ZwK0gvF6ifM2qhJNmfwi4UiudyJPb3V
+6ca0ySSMpiMhKQ8h6jCbCNWn0hdq+tjByC7M3+Z0SepbQmba3EX0ZdsjowPxwQuN
+FFebemFm7+7vOfGXztlWU6q/4JmtIR6Ixx4lJXz2UidCA9qIkAPwC7PT8bk5n5hc
+RWH6Q0xaPxVV6I7AsC7Kw8MTLZKM4nL6MULvJxY8vFCHGEQYy5j+MJx004qQieRv
+xQh/d++tfvW6pqDPjO/3z+veb0UY7d8BGM7xLZvcM9HgevrO+skgRX4jw4SaTa9e
+PAORmVQL9fgIHeVJgluaeA7LRhIHyPYIkSEVSpKw1bBq24vT0S6UMs5a09UZdBQ4
+5vce2Z9IgBuEm5fE8KH6Nh+EUNoNst7JBj5FXjTjZ7S93LkexgLC5bPOFMSuoLkA
+hNftrDCQ0vAOl29jF0qK4eC56uzDvnMrEX015mNRYaqz+NMWunFyM1FwIEE4AfE3
+KPM/T96sqd/80I6u9uuZ
+-----END X509 CRL-----

test/ca.key

@@ -0,0 +1,54 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIJnDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI2NJkoBPSHNsCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECJB8ZKETti83BIIJSEWVuAdbtE4u
+u5v8cAU5K//GjEaPSkXd9ZmrU5+xj/OIRxfbnICA5eGIL7Vk2nudAZAi+uXnjfK5
+9MgjUBHUbkriibU1FnbGRxSa26pILEjfZmy0WW9kMwn4Lc6POUapMFdGglzndjMw
+0DM5v2UbfWPs+NCVKir0bqIbcEHdar+M59ljZI/6zxjRRusW3/XmvvRpMeZQ/T3O
+hSKxsXtgaTTbcvDJWNJEU1CmxQ+6oX3cAnT5348CebY/FNr7rElnebWqbDFhnMb1
+MZwl51Z26XCTRFvUdfdXBmjWM4Yc+cIIWzZxBDUbwaeYPYjlgN2214iHNx9yFXzr
+1l0zE2a+/gVIQ26x3VQA0Cr97knswCWlJvg8TqJ61u3z4likQ+/bRd2dXtTB/rbH
+HTe2WRr6FGXiUYLxPmAsiLMam5Rh2d6A0MbeuJjmCNykj34FZp97/d5RXhb15WwO
+jiOlJ5f04c16V/OBYzDtHS+4vTz44cIE3bD83dQe6IBu/+z/rqwN1ezj+0FSCE1b
+sntc1QZLrd/J9d6kPBpL/b9NnR8nXcpbHTmXIOjLCSuDyz+JDBaGOh521DLVdkTp
+wq3ZJ2TzoJyIi+5KMBXelNm+RBLjHlLjxrT+Vd8uoqez78EY/m026EfSTWhlKGhF
+Hh5EmcAVk2nxZoLR6pjfwGIP0gQdWGhjm3vmto8QA2Cx4W39/jmWDZpQTznHzkrg
+za8BmrLbEsCyEpXQ+qS31R5TVGp9RjvDnHzC2PTQc9tc3+W5C9ZKysYpvWRslRFL
+p7Lkb9NTGli6BZMUXjiYmG83ziYSZ1O5nsasxItdMN6CRtskTnA+cDDeYBFJ80C/
++CZ012bLV/JRl/tu+zNYSnFDgCFC0PWbk+gAIPrIVrP2Ywn/wOXm1fswfdHroyJo
+xR4KvElHkOOswhexCwSgxukTheL9EuoYJ2BHc1WquZ6PGlnvAx7qXaZFv+NyGyV6
+S2Vtm2W4fwgY0lSzw4V8mq+ZRVVwhFjZkSV8abXRlg18MMA+9UAoJGaht1zm5e+C
+tBpD8HGp1m4/6RMUvm+zTTcnIFt3rs4QqyAydoBvU5gr7pZQAIU/njNLqPsTNY0P
+bH80E3NJgGBf0xsw3FEGfnq+uHr+kfgy82YueNV8NeLG5vxE4YTXC2a5kWIUB2WF
+wYYhbmEmATAxi8Rh4+OUxWBTMN8GIsVrUVMreFdaVsLKPQsTv8wivyVU1jCIbkYR
+CffmCCA81JzhHj8JyNfHA1dgnpVuyAiNek9rPONABst3eV5JHi6Xg1ok8iV3iAxt
+5sg4PW/Yehu58FS+zY2SpBhufieBqPf+pm0Gl550Ym2PLmwwZf5TXS+G/4Ty8gUu
+5yE/3/XM91XfzJD2Rwr4TKN8h7blyGw+RwTFZ6leyCKodvju9AMtwbDq2zx/ZAh5
+b8noJ3WJ2Klqq/5s/vk4od5+t9EWPF8MiOT74xU+FvS/whXNaqcW6ZTNaqFsKb7M
+1Yh/aRoksDGhsXVZJQOuP7GhfVUYi1oRfn10rVZX6tUS+vCmU4StPk6aufMZBwak
+gnSa4I5RUm+qixqDDmkwF6IJqFKEb8qyFfmApd3ErdkBJNArUqH52E7Aw8C8OWd4
+by/i13y52fFs5uXWL29zt9ChurqiK1ic5O0Yv3fsvjlJSjs5WFbW3Xh4iYNyKtTf
+fqEe2ngJAsUJegF8Q6vmipZr1RABd2vLann1MUcdwWyM1pBDrmsHz+gsEnfSE+UJ
+GaRbfCflJxPbJpJouiWWT4gzonVf2P1RfkzvI5iXQhuVziJa6JFCnf0t0GfsDie8
+jeN9hfhhZ+KdsOJwWnxOs8c1aZASL1EI6oLQKa61VFxfwehj2qxBUAmKkvRJVT4g
+PRwJkqh/O8B3fAw1j8zKy8rLdnsblRpuaBTzYdrb51sNW6pOhGVPCwzO+/UmBwhC
+5CIeH/aa2f+tyPBy6zNyHddAcgXEEs5IheQKx2vQVNNfMC0G3mEribKGSuZgE2jT
+C5YOvSjDxww6+bdzu/MQ9Kb6GUoFBZEYKT4xKQhAnNMANPJrmknNdc63N8MVuJvI
+vFkbE9tFAFHXE1sQhn6SobeKlDOl/M8quaqkpL7ArptLS2ALwvjUbAOuCKRaeb+A
+CzDKL056DuPUnzQ3cHVytzZ7WdKzJT4Px5LA+kKuMqDaDFb0U8FruFHQenhQkHR1
+kenPFN0hEd4+qfA7h0oaEpWsD05Nac4JJW8kvdz47u6dskLVVjn68IBhLcFZizEN
+lW1l2FvRHhz+ron2Qp8OenRla7QrsfVlm4W2CyRdesl72chEY7mU6+pjayP7GmnL
+WTlNgLxugEJa9a75nCgOcrdnM0baGj2cbO3S/mARWsnZxLVs16n4EIoX1pCE1UFG
+VPOFU/DHT5/3C8O3slnqSkwGykmOT2DN8J4l8msLgTIibzxNU3QtweDsCsVu332c
+aIOpTR/Q0m8Ucmu0kg0GjGsEfdw/3udDDLDQQ6dcDAbI4pllBfbAXGQWCX+5Py25
+iGokVYdH/EnyxqbRXPV8Wle086reF8r+YoPSmSjvg0EpcMkaEq36gOrluQZ6ELqo
+iJOvr6s0Z2C6WUk7xXzgSPH400gUcoMYGPbkXh5R/ynEDiurmJcstJdnltu3BViq
+WdDrnPDyP2WSW9Nmfpv01Z2ucjI4+qpfNRWw3hbKQP8ndVO7sxrZ6uanTzI43L8P
+gRlVz1w61ukdbUaVtCnfJit0U7sH0/d0Ek2MCvGPi1AkXx6eTLzIviFfLBx9rkGw
+eIvovT0Y3GXLJv7THbIvdhKuxSmSyRaO2GUU6y1JzneO8n64A4yvdvp2sVvTFgNz
+6th3quJSvhCrl/TQ4oKjJdphM1U7HaqrdEyZ6E0rVe5yzJ7Dxu0f7tKJ554Ftxjn
+gIZnHKSxQBBVmqfvvOc2PEK4kjKd8iAHBagd2Mhxs8ofl/ZVQIk/6Iy8AkAHofMA
+TcxAMWsX8R60HqUMocg+08zl5BxaFNuedq7h3pSJ2T4LRMMMxfN3hZH0MZqmqE7C
+n0t8vN9SeCRcUVW615Xyu2pDjByH++sPQHtoz9ANQaJWvtFLoV7tcI0jnygSc5y6
+jNH3Y9+lUvUiabCg10rbYj+zBKsIrebKbUvXJYU9kRGwJN/PkuG0iUtu4gqO3S0S
+NdX7BJ/DF87oeJ5zrOiJDg==
+-----END ENCRYPTED PRIVATE KEY-----

test/client.cer

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFGjCCAwICAWUwDQYJKoZIhvcNAQELBQAwUjELMAkGA1UEBhMCQVUxEzARBgNV
+BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
+ZDELMAkGA1UEAwwCQ0EwHhcNMTkxMjI1MTgwMDU4WhcNMjAxMjI0MTgwMDU4WjBU
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ0wCwYDVQQDDAR1c2VyMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAs2VoXPpXrgS6hozqEXRvoEiAsUBLQPuU6zKG
+Iui1VrYI5qKAgXNVRSkxWAVxrWXeMyp13+d4ZQpxT3XczoXd+Po0aaYvTyVAyjYL
+JIAdZIw/ZDm5D6FEnxDFGa6xW/JTrVQR7Sm1tR5KLDqgzBgfDl1CbuRtwvaNeC/8
+uBeWLcU0LzuX2pH8goIvpHkZ0WB4BAJhu9qj2+cfSN6Ic/iBFieisyX++Z2pf7Nh
+I69WTuZgt+K/yNaCUmVn9GFMj9FmTH1hzhxAR5DQgPW6dpQlWgQVJu9Y/bsBv0VJ
+lrkJ5sYAKT/dH/nRpEm1qpIsaIE0JGQs8xx/anWvBgt9B6k+va4fksEbzgCHlI8G
+UcNKpaKWnvSy0OgC9NIqQ0R6xnFhWrIatWXOraF6QNRBvGJrO5/m+8cCrNMk36KH
+4qG+926yTSb6SlqvCsc+SkNmNAYLuJ4tJ7wtvN0RLbgIwtHaXsz6SUJLdqDgxv9l
+ICFF962zDmneMg8I+dlM0dCnJ80E4syGGDaPB05lKskFD99q6l6o5mvuOPXQtDfr
+4QItuh/FCj1Ue2oHQWXVMOcgLnKM6ev9CIbE3k059EGnyK7uOh0LFqSfs2Jzs9Gw
+clUX44nldqwrkckhHwG58oXwVoSZUQT/FNgsHcCkA7nu8kJWvALNfeuzA09gbvm9
+wyyjIVECAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAnGiACGmEvF1UUDa2gBS2kAtw
+qr1BWrJgzzOQ9ZEoKlWzx3WcVU5VYgPjBG1VxJ4S66Lxl6TEKy/kkOpONT8QvsmX
+hhqtcPVo22GBHpt4TMa0yPn6qJMMIOwAZQyiuq7Gsj+sv7itxZgTe1O0D+N6M4+5
+EeS5QqoaQDrl5V6kwABX4TkuNTyAnVDhEGHLn2FuEVbjF6JvNKsmcNncGh2yBo/x
+BDnjwYjp6v1DIC8t2R+S8wZXzlpP1iLTjp6WkTTFylZmBRj+vhTCgXVe+wf8IhRO
+xqUV+bQramWr4L3IXJCazmveVG5uzfrj4alJHJzMmOn4bFKqwgYyB8j9hX+zrYy4
+iyJ9akkaX27/TROvhrduycB000zETgPDkkvKsiLRzP/IykosgG+BlnGBKV6ro2De
+AvCRnuhoNg7aUP5QsmI1FST2Hx31AjqgZWbwsf8R4TApyW36Sn4oCArA19LJE20f
+hEb1q7cNjICBNVajN8+uTYPy+fhXd8GKtmoYkPh4If1Lfps9TGtFntewbecv1DMK
+xJa47N60EKuE22Dv79cXaB5rgPwlzyFWDVat5FH/4722ttevktGnqHXOjq0HOjHO
+xDv01vGQr33KMM8pxWAo1GfgKgMabNvqREdvgO2UdutVzrD+UFIK9m+8Imt5u7Bm
++dweUTSg4WfaquqhsKc=
+-----END CERTIFICATE-----

test/client.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEAs2VoXPpXrgS6hozqEXRvoEiAsUBLQPuU6zKGIui1VrYI5qKA
+gXNVRSkxWAVxrWXeMyp13+d4ZQpxT3XczoXd+Po0aaYvTyVAyjYLJIAdZIw/ZDm5
+D6FEnxDFGa6xW/JTrVQR7Sm1tR5KLDqgzBgfDl1CbuRtwvaNeC/8uBeWLcU0LzuX
+2pH8goIvpHkZ0WB4BAJhu9qj2+cfSN6Ic/iBFieisyX++Z2pf7NhI69WTuZgt+K/
+yNaCUmVn9GFMj9FmTH1hzhxAR5DQgPW6dpQlWgQVJu9Y/bsBv0VJlrkJ5sYAKT/d
+H/nRpEm1qpIsaIE0JGQs8xx/anWvBgt9B6k+va4fksEbzgCHlI8GUcNKpaKWnvSy
+0OgC9NIqQ0R6xnFhWrIatWXOraF6QNRBvGJrO5/m+8cCrNMk36KH4qG+926yTSb6
+SlqvCsc+SkNmNAYLuJ4tJ7wtvN0RLbgIwtHaXsz6SUJLdqDgxv9lICFF962zDmne
+Mg8I+dlM0dCnJ80E4syGGDaPB05lKskFD99q6l6o5mvuOPXQtDfr4QItuh/FCj1U
+e2oHQWXVMOcgLnKM6ev9CIbE3k059EGnyK7uOh0LFqSfs2Jzs9GwclUX44nldqwr
+kckhHwG58oXwVoSZUQT/FNgsHcCkA7nu8kJWvALNfeuzA09gbvm9wyyjIVECAwEA
+AQKCAgAyHiGC4DmAlzeZAWMfDz1kNP0nB8Q+WkqnTo0k0YhfuilQbZOjFpp64OA1
+LAgvHiduee1GaT88UyeGwHG4jLOPrC7aWSAcZ1brZx/DybrsbTYEhQ/Law1ltuSp
+oSFRg6iW4sbDUATAnb6xDov/mLmMZMd7fXugnQq2ygk7UPOWw+IpU+e/m0tFFqPC
+ukZZNS8yR4wQVCu08qPN0sWiSImfq+ELVZEfIUnKME3yDzj4f+oDVWio7iyoYkYh
+gtFF2IVQ1zJsx325wJ5PeNbn68lnlX5nSzS8ZfM+AVhmsDkw7J386CeZmExWLnV/
+OqkHZRkxFX9tR8fc8RW9hZYffsvU77MhbbekSrD3gZSXUaiLJNJC0a6Imxgi66jm
++EBhPTehmEOLNYKgYkEXHS6aW8WeQ/Vp0rQyjNAd+z4mXCX+VRi5Ek/ibGpLec1Z
+3hLfS+UPLGC9TK2+flSI66ikS9q/9lvN1Dj1b+RVd5Aq6I3cy/bHnZjm3S8+Q/kX
+Dlxu0ELuIwXphOP5mLeevCcATYAvC0stS0NXBxL/L+Ci78eW4PEMR4SIVqOaOTVR
+QSVevpwIRT1Xxz9KLdoW7kKR9eUu5GcqY08sRYWhSBvKQh/X30IMK2JmjDx40ZDK
+yeq/xeJND8ichiSEUZhkm9K7oKQrs+CPe1+aKKlDL2HxTM1YAQKCAQEA7Cao0aev
+qOSXQrpCFAwOAc1DkAhwCU4/1rjx4jKF0kSBjTK+9GwxNoGV8FKiV/ZNmatEIJfs
+z4zGrHxDy+Q4SHjjzRzhxn+t0NBtwtt9sq9OJezDIqcW/bQGk4KRlAlAUyy+jUza
+Wj0dbDeHtTAJGgFBDxjpJzxypY8nsvfrl5rVmMJilfmGBsLOvBvzwLDL3xAfO+vP
+ks98mM6csgxaYdkXuz/NWZzEMxTNfhmDf0ScWp0TL6uwlPpXgICoITA5dYZiLf1t
+ERCME6nEmuKzrDCWLmZXtyc9UfK9QgHkjx5eb8vpLFPlbIDMb+5tzKVTHVuKF+Zc
+R7g0Nqpc1andgQKCAQEAwnmIwuCbMtwhxRoXHp1Wojwreh+PJGkloCfG2J9lhrOb
+W7p1PyYj7RxqNHYexouqEBTLQ/Q/VfQzevVTDDZZ7lKa50gKWUEGMBDwtuTvI3eN
+7CayvYeN64OWIXCzzN45EYNSW7/LD/xxvtXrolb8drOOSiN59CvzSA1SF3vK0TxE
+rygbqHoe/UKIhFmlawyM7+YQPQSaUZGQ1/t9DAQHt29ZT7ELeg1iL/KQXtotjuve
+Tsh2BisgMmvQJe3zbTe04GzThnQx+mQ4e43BZsnfqap7b5k2Ou3+9v6yzTN6xdeG
+QvYQaNA60OByuW9yI0jm6shbfgR51fVirBLC0lDL0QKCAQB85umtkhqHovgaE/e1
+MLcL3uxYNw5C7b84K7PL5tr+3rsC2o9DKiJRaPLMHHi/O4fJulsbPh/DmvrN6h/V
+rIzUUBR0vUzxN0DQzBzxzjPKmYwk5PhE0MmJQHml9Y5YFRiPpX/Xroli5yYzwZ8m
+hxSZS4aEnLFczkz5IiFmOFjEY+GLnWyVVFe+JbVAqyweg6QhBB7xC4VLajDFhao9
+RelcDX3OzS0os5DWT69sfcQeQUTNbHzkXtPTyCEV13aVrzME5SHynzLbrrvX/pf9
+L+DGNyCHxBuqxLdbK59MVUH1LKPYT6qxhmI3JFx860fp0JuIUI1WnMG8MUJ0k2Ds
+pZ6BAoIBAA/UwuxSSnAGeX1JFW65ki7cxRFI9mcZZCW4dzh1KVeg0VnTQO4mFbCc
+qoygvPqerfZnKvDaNjmyCmrNA7ivx/xdnxyKwcToRS+ugVnyIwF5HwWFVPGW0lfE
+u3j3aruXr3+ceBzd7RLdEwlc8rShbiXfkgq4/pmA5moMI42j1yvXQyQbGL1LS7CE
+NQbJIW0odWSmDtZYxJM1TVw3rcNHpLUrDFMvb2a9JiwPC++cxS6oRs2VBf6Ujids
+nWIpD7LpYQEP+twsI1FlzS9Jp9/NOTbfmPLJvx9m9mV28GlB8pGebOCQlV9i7BbK
+3qv3xYvXyGx+aOxGQwDG3ARz9oYWa7ECggEAHOr5YYpZtFm1uIG4rArZwJ/d3NW5
+ElX+UvGhKO87u5+f2eLmVWP92EWxN4WfDT+GqzXt4rY/Y0WHZd1E0TcHMRuUNf/X
+HY90sgkjXHivJJWZYrWAb+zV78Dl4j8B9wXiJ9N2V9bbp0iZLU74AARfntl3j0xP
+Ae46bNSq5Qgrec97UGtoyVHObFD2aVtAYyu/KPwjXcJAhWhpfopk0Wb4T4I1+skh
+zaVpVXcjeRB24fwCnp8VwMlDf3huCSkZyjhBSkM12RZpJnPsoDN+RKQrRnUoh1li
+9UiaLwR/XVro1BXm62p7/tCqbZb0rJAck2NMiZ9R77TlkAYliEEQgGSXCw==
+-----END RSA PRIVATE KEY-----

test/example.htpasswd

@@ -0,0 +1 @@
+user:$apr1$UdluOkCM$AJC2FL37UkLrSZg8DSw0V.