{"record":{"id":"42b9bbd6fe7357fb","repo":"t8y2/dbx","slug":"tdengine-rust-websocket-connector-does-not-support","errorCode":null,"errorMessage":"TDengine Rust WebSocket connector does not support client certificate authentication","messagePattern":"TDengine Rust WebSocket connector does not support client certificate authentication","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/tdengine/src/config.rs","lineNumber":21,"sourceCode":"use std::net::IpAddr;\nuse url::Url;\n\nuse crate::model::ConnectParams;\n\nconst DEFAULT_HOST: &str = \"127.0.0.1\";\nconst DEFAULT_PORT: u16 = 6041;\nconst DEFAULT_USER: &str = \"root\";\nconst DEFAULT_PASSWORD: &str = \"taosdata\";\n\n#[derive(Debug)]\npub struct BuiltDsn {\n    pub value: String,\n    pub database: String,\n}\n\npub fn build_dsn(params: &ConnectParams) -> Result<BuiltDsn> {\n    if !params.client_cert_path.trim().is_empty() || !params.client_key_path.trim().is_empty() {\n        bail!(\"TDengine Rust WebSocket connector does not support client certificate authentication\");\n    }\n\n    let mut url = if params.connection_string.trim().is_empty() {\n        build_from_fields(params)?\n    } else {\n        normalize_connection_string(params.connection_string.trim(), params.ssl)?\n    };\n\n    apply_connection_fields(&mut url, params)?;\n    merge_query_params(&mut url, &params.url_params);\n    if (params.ssl || !params.ca_cert_path.trim().is_empty()) && url.scheme() == \"ws\" {\n        url.set_scheme(\"wss\").map_err(|_| anyhow::anyhow!(\"failed to enable TLS in TDengine connection URL\"))?;\n    }\n    if !params.ca_cert_path.trim().is_empty() {\n        set_query_param(&mut url, \"tls_mode\", \"verify_identity\");\n        set_query_param(&mut url, \"tls_ca\", params.ca_cert_path.trim());\n    }\n    let database = url","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/tdengine/src/config.rs#L3-L39","documentation":"build_dsn constructs the WebSocket connection string for the TDengine driver. The Rust WebSocket connector does not implement mutual TLS (client certificates), so supplying a client cert or key path is rejected up front instead of being silently ignored. This is a fail-fast guard for unsupported configuration.","triggerScenarios":"Calling build_dsn (via connect) with ConnectParams where client_cert_path or client_key_path is non-empty after trimming — e.g. configuring mTLS fields in the TDengine agent connection settings.","commonSituations":"Copying a JDBC or native-connector config that uses mutual TLS, or security teams mandating client certs; users assume the WebSocket connector supports mTLS like other drivers.","solutions":["Remove the client_cert_path/client_key_path values from the connection params","Use the TDengine native (non-WebSocket) connector if mutual TLS is required","Keep TLS server verification via the CA path only (ca certificate support is accepted for WebSocket)"],"exampleFix":"// before\nparams.client_cert_path = \"/etc/certs/client.pem\".into();\n// after (WS connector: no client cert)\nparams.client_cert_path = \"\".into();\nparams.client_key_path = \"\".into();\nparams.ca_cert_path = \"/etc/certs/ca.pem\".into();","handlingStrategy":"validation","validationCode":"if !params.client_cert_path.trim().is_empty() || !params.client_key_path.trim().is_empty() {\n    return Err(anyhow!(\"mTLS is not supported by the WebSocket connector; drop client cert/key or use the native connector\"));\n}","typeGuard":"fn is_ws_compatible_tls(p: &ConnectParams) -> bool {\n    p.client_cert_path.trim().is_empty() && p.client_key_path.trim().is_empty()\n}","tryCatchPattern":"match build_dsn(&params) {\n    Err(e) if e.to_string().contains(\"client certificate\") => configure_native_connector_or_drop_mtls(),\n    Err(e) => return Err(e),\n    Ok(dsn) => connect(dsn),\n}","preventionTips":["Only set ca_cert_path for WebSocket TLS","Document that mTLS requires the native connector","Validate connection params before persisting profiles"],"tags":["rust","tdengine","tls","mtls","configuration"],"backgroundTag":"mtls-not-supported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}