An "incorrect password" error is received when importing the generated Client .p12 mTLS certificate on iOS.
My understanding is this is frequently caused by incompatible encryption methods between modern certificate generation tools (like OpenSSL 3.x and in this case SSLMate’s go-pkcs12 Modern) and iOS’s older security standards.
The relevant portion of code is below:
// Generate PKCS#12 (.p12) file
p12Data, err := pkcs12.Modern.Encode(clientKey, clientCert, []*x509.Certificate{caCert}, req.P12Password)
if err != nil {
return nil, fmt.Errorf("failed to generate PKCS#12: %w", err)
}
If this is changed to:
// Generate PKCS#12 (.p12) file
p12Data, err := pkcs12.Legacy.Encode(clientKey, clientCert, []*x509.Certificate{caCert}, req.P12Password)
if err != nil {
return nil, fmt.Errorf("failed to generate PKCS#12: %w", err)
}
The generated client certificates can be imported by iOS devices.
I have forked the repo and tested it (it works) but would not advocate this change. An option to select legacy (only when required) would be preferable. Unfortunately the changes to the database where certs and keys are stored and the UI to make Legacy selectable are beyond me.
44a80ab152
Co-Authored-By: gerthomas <34512947+gerthomas@users.noreply.github.com>
add safety across services: whitelist tables for DeleteInTransaction to prevent dynamic-SQL deletion abuse; remove a deprecated UpdateInTransaction helper. centralize HTTP client creation (HTTPClientWithTimeout/GetHTTPClient) and replace ad-hoc http.Clients with it; limit response body reads with io.LimitReader to avoid unbounded memory use; add better error logging when JSON marshal fails. Improve ConfigProxy cache handling to fetch outside locks, return stale cache on fetch errors, and only lock to swap the cache; add locking to SetCacheDuration and cap error body reads. convert ResourceWatcher isRunning to atomic.Bool for safe concurrent start/stop. Replace sync.Map memoization in id_normalizer with a bounded map protected by RWMutex (maxCacheSize), add cache flush behavior and tests/benchmarks to validate boundedness and hits. Miscellaneous test updates to match new behavior.
add a legacy_p12 boolean to CreateClientRequest (backend model and frontend type) to support generating PKCS#12 files with legacy encryption for iOS/older device compatibility. CertGenerator now selects pkcs12.Legacy when legacy_p12 is true (defaults to Modern otherwise). UI: add a checkbox to the client cert creation dialog and initialize form state to include legacy_p12.
Add an 'Inspiration' section to README.md crediting @AstralDestiny for inspiring the api shim, with a short appreciation note.
Co-Authored-By: AstralDestiny <20157872+astraldestiny@users.noreply.github.com>
Key middleware entries in generated and proxied Traefik configs by middleware name (so chain references by name work) instead of by ID. Join middleware names in resource queries and scan them (with fallback to ID when name is not available), add Name fields to middleware structs, and use the extracted base name when building final middleware references. Also update log messages to include both name and ID. In the UI, enforce and auto-sanitize middleware names to lowercase a-z0-9- and hyphens only.
Refine PluginCard UI: show 'Installed (Error)' when an installed plugin has an error, change the 'not_loaded/configured' state to use a secondary variant and label it 'Installed' (with Activity icon), and update the remove button from destructive to outline while applying destructive text/hover styles. These tweaks clarify installed states and make the removal action visually less aggressive while preserving disable/tooltip behavior.
Add extensive unit tests across the codebase (api/errors, cache, many models tests, util/id_normalizer and others) to improve coverage and validate behavior. Replace ServiceWatcher.isRunning bool with atomic.Bool for safer concurrent access, update Start/Stop logic and related imports, and adjust service_watcher_test accordingly. Also update traefik_fetcher_test to use atomic counters for request counting and add minor import changes (sync/atomic).
Visual and structural refresh across the UI: adjust spacing and paddings, update theme tokens, and simplify several components for a cleaner look and interaction.
Highlights:
- App.tsx: increased main vertical padding (py-8).
- EmptyState: switched to muted translucent background and larger padding.
- Header: refined nav button styles (hover/opacity), added primary icon color, tighter spacing, replaced Button with native button, added active underline indicator and improved text styles.
- Dashboard: spacing tweaks (space-y changes), replaced Globe icon for TCP Routes with Network, updated stat descriptions and colors, moved New Middleware button inline, removed the old Quick Actions card grid and cleaned up tabs content spacing.
- StatCard: refactored layout (removed trend), added color prop with icon color mapping, updated typography and hover/border effects.
- ui/card: adjusted card border/shadow for dark mode and reduced CardTitle size.
- ui/table: tightened header/cell sizing and updated header styling to uppercase/tracking.
- globals.css: overhauled light/dark CSS color variables (hue/saturation/lightness values) and adjusted scrollbar thumb opacity.
These changes aim to unify the visual language, improve spacing and responsiveness, and simplify card/stat presentation for better clarity and interactivity.
Remove hardcoded plugin version in SecurityHub and prefer the plugin catalogue's recommended/latest version when available. Updated mtlsStore to import pluginApi, fetch the catalogue in checkPlugin, and set pluginStatus.version and recommended_version (fallbacks: installed -> recommended -> empty/default). Added MTLS_PLUGIN_MODULE constant and resilient error handling for catalogue fetch. Also added recommended_version to PluginCheckResponse type and updated UI snippets/badge to show installed or recommended version.
Introduce support for Traefik-native external middlewares referenced by resources.
- Database: add resource_external_middlewares table in migrations and ensure creation in post-migration updates.
- API: add handlers and routes to assign, remove and list external middlewares; include external_middlewares field in GetResources/GetResource responses (comma-separated name:priority:provider entries). Handlers validate resource status, use transactions, and log errors.
- Services: ConfigProxy now loads external middleware refs, merges them with internal middlewares sorted by priority when building resource config.
- UI: Resource detail component, API client, store and types updated to expose listing, assigning and removing external middlewares with UI controls and confirmation modal.
- Tests: add unit tests for assign/remove/list handlers and inclusion on GetResource.
This enables referencing middlewares defined outside MW-manager (e.g., Traefik dynamic config or plugins) and honors priority/provider metadata.
Refactored test files to use more idiomatic struct initialization and helper functions, reducing boilerplate and improving clarity. Added t.Skip calls to tests that are outdated or pending updates, and updated assertions in traefik_fetcher_test.go to use new method names. These changes improve maintainability and prepare the codebase for upcoming changes in fetcher and watcher behaviors.
Update TestDataSourceConnection to support requests with an empty body by loading the existing data source config if available. Returns 404 if the data source is not found, otherwise proceeds as before.
