@@ -4,10 +4,13 @@ import (
44 "crypto/aes"
55 "crypto/cipher"
66 "crypto/rand"
7+ "crypto/x509"
78 "encoding/base64"
89 "encoding/hex"
910 "fmt"
11+ "github.com/pusher/oauth2_proxy/pkg/logger"
1012 "io"
13+ "io/ioutil"
1114 "net/http"
1215 "strings"
1316 "time"
@@ -64,6 +67,28 @@ func newRedisClient(opts options.RedisStoreOptions) (*redis.Client, error) {
6467 return nil, fmt.Errorf("unable to parse redis url: %s", err)
6568 }
6669
70+ if opts.RedisInsecureTLS != false {
71+ opt.TLSConfig.InsecureSkipVerify = true
72+ }
73+
74+ if opts.RedisCAPath != "" {
75+ rootCAs, _ := x509.SystemCertPool()
76+ if rootCAs == nil {
77+ rootCAs = x509.NewCertPool()
78+ }
79+ certs, err := ioutil.ReadFile(opts.RedisCAPath)
80+ if err != nil {
81+ return nil, fmt.Errorf("failed to load %q, %v", opts.RedisCAPath, err)
82+ }
83+
84+ // Append our cert to the system pool
85+ if ok := rootCAs.AppendCertsFromPEM(certs); !ok {
86+ logger.Printf("no certs appended, using system certs only")
87+ }
88+
89+ opt.TLSConfig.RootCAs = rootCAs
90+ }
91+
6792 client := redis.NewClient(opt)
6893 return client, nil
6994}