codesnips
go 33 lines · 1 tab

mTLS client configuration with custom root CA pool

Leah Thompson Jan 2026
1 tab 
package deps

import (
  "crypto/tls"
  "crypto/x509"
  "net/http"
  "os"
)

func NewMTLSClient(caPath, certPath, keyPath, serverName string) (*http.Client, error) {
  caPEM, err := os.ReadFile(caPath)
  if err != nil {
    return nil, err
  }
  pool := x509.NewCertPool()
  pool.AppendCertsFromPEM(caPEM)

  cert, err := tls.LoadX509KeyPair(certPath, keyPath)
  if err != nil {
    return nil, err
  }

  tr := &http.Transport{
    TLSClientConfig: &tls.Config{
      MinVersion:   tls.VersionTLS12,
      RootCAs:      pool,
      Certificates: []tls.Certificate{cert},
      ServerName:   serverName,
    },
  }

  return &http.Client{Transport: tr}, nil
}
1 file · go Explain with highlit

For internal service-to-service calls, mutual TLS is a pragmatic way to get strong identity without bespoke auth headers. The main pitfalls are certificate rotation and trust configuration. I build a x509.CertPool from a dedicated internal CA, load a client certificate/key pair, and set MinVersion to TLS1.2 (or newer) to avoid legacy negotiation. The tls.Config also sets ServerName so hostname verification happens correctly; skipping verification is a common anti-pattern. In production I pair this with short-lived certificates and automatic reload, but even the static version shown here is a solid baseline. When something breaks, the errors are actionable: either trust is wrong, cert is expired, or the peer identity doesn’t match.

Related snips

go 
package api

import (
  "net/http"
  "runtime/debug"
)

Expose build metadata for debugging deploys

go observability build
by Leah Thompson 1 tab
ruby 
payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,

JWT issuance and verification without common footguns

jwt authentication api
by Kai Nakamura 2 tabs
typescript 
export interface RetryOptions {
  retries: number;
  baseMs: number;
  maxMs: number;
  signal?: AbortSignal;
  onRetry?: (attempt: number, delay: number, err: unknown) => void;

Exponential backoff with jitter for retries

typescript reliability retry
by codesnips 2 tabs
go 
package dbutil

import (
  "context"

  "github.com/jackc/pgconn"

Retry Postgres serialization failures with bounded attempts

go postgres transactions
by Leah Thompson 1 tab
bash 
#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

Secrets management with environment isolation and Vault

secrets-management vault environment-variables
by Kai Nakamura 1 tab
typescript 
import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";

const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";

JWT access + refresh token rotation (conceptual)

security node jwt
by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

mTLS client configuration with custom root CA pool — share card
Link copied