Issue 17: Mutual TLS Gateway Implementation Supporting Custom X.509 Meter Anchors

[elizabetheonoja-art]

File: /src/gateway/mtls.rs

Category: Gateway / Security

Description: The build_mtls_acceptor function loads a single CA certificate file for client verification. This does not support multiple independent trust anchors for different meter manufacturers, certificate authority hierarchies (intermediate CAs), or certificate revocation via OCSP stapling. Additionally, there is no support for hardware security module (HSM) key storage for the server certificate.

Parameters:

• Trust anchors: 10+ meter manufacturer CAs
• Certificate chain depth: up to 3 (root → intermediate → device)
• OCSP stapling: required for real-time revocation checking
• Server key storage: PKCS#11 URI for HSM

Codebase Navigation:

1. src/gateway/mtls.rs:8 — build_mtls_acceptor — single CA cert support
2. src/gateway/mtls.rs:20 — RootCertStore::add — no intermediate CA chain handling

Resolution Blueprint:

1. Extend build_mtls_acceptor to accept a directory of CA certificates; load all PEM files and add each to the root store
2. Implement intermediate CA chain building: when a client presents a certificate signed by an intermediate, validate the full chain up to a configured root anchor
3. Add OCSP stapling support: when a client certificate is received, check its OCSP responder URL (from Authority Information Access extension) and staple the OCSP response
4. Add HSM support for the server private key: use pkcs11-uri to reference the key in an HSM instead of a file path
5. Implement certificate policy enforcement: validate X.509 certificate policies extension against a whitelist of accepted policies (e.g., manufacturer-specific OIDs)
6. Expose GET /api/v1/gateway/tls/status showing current certificate chain, expiry dates, and OCSP response status

Acceptance Criteria:

• 10+ manufacturer CA anchors accepted simultaneously
• Intermediate CA chain validated correctly
• OCSP stapling responses verified before accepting connection
• HSM-stored key used for server TLS termination

[Penielka]

can i be assigned this to fix

[grantfox-oss]

🦊 GrantFox — @Penielka has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #17)
2. Your PR will be reviewed by the Utility-Protocol maintainers

Good luck! Track your progress on GrantFox.