Summary

Validate that certificates configured as root CAs are actually CA certificates at startup, preventing misconfiguration where a server leaf certificate is accidentally set as a root CA.

Changes

• Add parseAndValidateCACerts function that validates PEM-encoded root CA certificates have the IsCA flag set.
• Reject non-CA (leaf) certificates, invalid PEM data, and non-CERTIFICATE PEM blocks with clear error messages.
• Use project error definitions (errors.DefineInvalidArgument) for consistent error handling.
• Handle trailing whitespace in PEM files gracefully.

Testing

Steps

Run the unit tests:

go test ./pkg/config/tlsconfig/... -v -run TestApplyTLSClientConfig

Results

Unit tests pass.

Regressions

• Client.ApplyTo now validates certificates before adding them to the root CA pool. Previously, any PEM certificate (including leaf certs) was silently accepted. Existing valid configurations are unaffected.

Notes for Reviewers

...

Checklist

• Scope: The referenced issue is addressed, there are no unrelated changes.
• Compatibility: The changes are backwards compatible with existing API, storage, configuration and CLI, according to the compatibility commitments in README.md for the chosen target branch.
• Documentation: Relevant documentation is added or updated.
• Testing: The steps/process to test this feature are clearly explained including testing for regressions.
• Infrastructure: If infrastructural changes (e.g., new RPC, configuration) are needed, a separate issue is created in the infrastructural repositories.
• Changelog: Significant features, behavior changes, deprecations and fixes are added to CHANGELOG.md.
• Commits: Commit messages follow guidelines in CONTRIBUTING.md, there are no fixup commits left.