tls_https

Okapi TLS & HTTPS

Loading a TLS Config

func okapi.LoadTLSConfig(certFile, keyFile, caFile string, clientAuth bool) (*tls.Config, error)

Parameter	Description
certFile	Path to the certificate (PEM)
keyFile	Path to the private key (PEM)
caFile	Optional CA certificate for verifying client certs — "" disables
clientAuth	Require client certificate verification (mTLS)

HTTPS-Only Server

tlsConfig, err := okapi.LoadTLSConfig("cert.pem", "key.pem", "", false)
if err != nil {
    panic(err)
}

o := okapi.New(okapi.WithTLS(tlsConfig), okapi.WithAddr(":8443"))

o.Get("/", func(c *okapi.Context) error {
    return c.OK(okapi.M{"status": "secure"})
})

o.Start() // ListenAndServeTLS

When the server's TLSConfig is set, Start() serves HTTPS on the configured address.

Dual HTTP + HTTPS

WithTLSServer runs a second listener with its own address, sharing the same routes and middleware:

tlsConfig, _ := okapi.LoadTLSConfig("cert.pem", "key.pem", "", false)

o := okapi.Default()                        // HTTP on :8080
o.With(okapi.WithTLSServer(":8443", tlsConfig)) // HTTPS on :8443

o.Start() // HTTP served in a goroutine, HTTPS in the foreground

Stop() / StopWithContext(ctx) gracefully shut down both listeners.

Mutual TLS (client certificates)

tlsConfig, err := okapi.LoadTLSConfig("server.crt", "server.key", "ca.crt", true)
o := okapi.New(okapi.WithTLS(tlsConfig))

With clientAuth: true, the CA in caFile verifies presented client certificates. Inspect the peer in a handler:

o.Get("/whoami", func(c *okapi.Context) error {
    tls := c.Request().TLS
    if tls == nil || len(tls.PeerCertificates) == 0 {
        return c.AbortUnauthorized("client certificate required")
    }
    return c.OK(okapi.M{"cn": tls.PeerCertificates[0].Subject.CommonName})
})

Custom *tls.Config (autocert / Let's Encrypt)

The *Okapi struct has no exported fields, so supply a pre-built *http.Server instead of assigning to one: