Feature request: Support custom CA cert in Database secret backend config

[vreon]

Feature Request:

When configuring the database secret backend to connect to a MySQL database, you can specify ?tls=true, false, or skip-verify in the connection_url DSN, but there's no mechanism for providing a custom CA certificate (e.g. for a private CA).

go-sql-driver/mysql supports a ?tls=<name> option, but <name> must first be registered with mysql.RegisterTLSConfig. (For example, the MySQL storage backend uses this to implement the tls_ca_file setting.)

References:

Mailing list discussion: https://groups.google.com/d/msg/vault-tool/QEQ-07CLNpo/zORnEe3yCAAJ

[martinssipenko]

It looks to me that this was implemented by #9181?

cc @jefferai @vreon

[Andor]

@martinssipenko Close enough, but not all mysql features are supported. For instance, there are no client authorisation with certificates. (which also could be signed by Vault CA).

[martinssipenko]

What do you mean @Andor? Isn’t tls_certificate_key exactly for specifying a TLS cert for mutual TLS (client auth with certs).

[vreon]

Thanks for the heads up, @martinssipenko! Closing this as fixed.

[Andor]

@martinssipenko Oh, yeah, you are right!