Interested in a PR for mTLS

[MarkJepson]

Application

Shlink

Application version

v5.1.5

How do you serve the application

K8s

Database engine (if any)

MariaDB

Database version

11.8.8

Summary

I'm running Shlink in a Kubernetes cluster where the database enforces mutual TLS — every client must present a certificate, not just trust the server's. Shlink's DB_USE_ENCRYPTION currently only does one-way TLS (and trusts any server cert), so there's no way to present a client cert for the pdo_mysql/pdo_pgsql connection.

I'm working on a patch that adds DB_CLIENT_CERT_PATH, DB_CLIENT_KEY_PATH, and DB_CA_CERT_PATH env vars, wired into the existing driverOptions in config/autoload/entity-manager.global.php (setting Pdo\Mysql::ATTR_SSL_CERT/ATTR_SSL_KEY/ATTR_SSL_CA, plus turning on ATTR_SSL_VERIFY_SERVER_CERT when a CA is supplied). Using Claude Code to help draft it, but I'll test and review everything myself before opening anything.

Would this be a welcome PR, or is there a reason mTLS-style DB auth hasn't been added already? Also open to different env var names if you have a preferred convention.

[acelaya]

Using Claude Code to help draft it

Not interested

[MarkJepson]

No worries. mTLS is working for me now. AI assisted development is not to everyone's taste