==============================================================================
docs/output/06-mtls.txt
Client-certificate authentication on port 8443, server.ssl.client-auth=need.
Certificates from scripts/certs.sh. edge.crt and rogue.crt have IDENTICAL subjects and
different issuers.
==============================================================================

$ openssl x509 -in target/certs/edge.crt -noout -subject -issuer
subject=CN = edge-service, OU = payments
issuer=CN = Internal Mesh CA
$ openssl x509 -in target/certs/rogue.crt -noout -subject -issuer
subject=CN = edge-service, OU = payments
issuer=CN = Some Other CA

$ curl --cert edge.crt --key edge.key https://localhost:8443/mtls/whoami
{
    "principal": "edge-service",
    "authenticationType": "PreAuthenticatedAuthenticationToken",
    "authorities": [
        "ROLE_SERVICE",
        "FACTOR_X509"
    ],
    "certificateSubject": "OU=payments,CN=edge-service",
    "certificateIssuer": "CN=Internal Mesh CA"
}

$ curl --cert rogue.crt --key rogue.key https://localhost:8443/mtls/whoami
[curl exit 56, http 000]

$ curl https://localhost:8443/mtls/trusted-header    # a permitAll() endpoint
[curl exit 56, http 000]

$ curl --cert edge.crt --key edge.key -H 'X-Client-Cert-Subject: CN=payments-service' \
       https://localhost:8443/mtls/trusted-header
{"caller":"CN=payments-service","verifiedBy":"nothing. This endpoint believes a header."}

# Three things worth reading twice.
# 1. The rogue certificate fails with curl exit 56 and NO http status. The handshake
#    is rejected; the application never sees a request and logs nothing at INFO.
# 2. So does the permitAll() endpoint. client-auth=need is a property of the
#    CONNECTOR, not of a path. You cannot expose a public endpoint on that port.
# 3. The last call is what a mesh deployment usually looks like from inside the
#    application: an identity taken from a header, verified by nothing.