feat(config): add mTLS (mutual TLS) support

[prateek-kumar-improving]

Describe the feature

Add mutual TLS (mTLS) support to the Valkey GLIDE PHP client. mTLS enables two-way certificate authentication between the client and the Valkey server, where both parties present and verify certificates. This is already supported in other GLIDE language clients (Java, Python, Node.js) but is currently missing from the PHP implementation.

Use Case

Secure enterprise deployments often require mTLS to ensure that only authorized clients can connect to database servers. Without mTLS support, PHP users cannot:

• Meet zero-trust network security requirements that mandate mutual authentication.
• Deploy Valkey GLIDE PHP in environments where server-only TLS is insufficient (e.g., regulated industries, multi-tenant cloud environments).
• Achieve feature parity with other GLIDE language clients that already support mTLS.

Proposed Solution

Extend the advanced_config['tls_config'] array to accept client_cert and client_key parameters for mTLS authentication. The implementation should:

1. Add client_cert and client_key fields to valkey_glide_tls_advanced_configuration_t in common.h.
2. Parse the new options from the tls_config array in the connection configuration (similar to how root_certs is handled today).
3. Pass the client credentials through to glide-core via the protobuf ConnectionRequest fields (client_cert = field 22, client_key = field 23) in valkey_glide_core_commands.c.
4. Support both file-path-based and in-memory (PEM string) certificate loading.
5. Update valkey_glide.stub.php and valkey_glide_cluster.stub.php with the new configuration options and documentation.

Example PHP usage:

php
$client = new ValkeyGlide();
$client->connect(
addresses: [['host' => 'localhost', 'port' => 6379]],
use_tls: true,
advanced_config: [
'tls_config' => [
'root_certs' => $ca_cert_data,
'client_cert' => $client_cert_pem,
'client_key' => $client_key_pem,
]
]
);

Reference implementations:

• Java GLIDE mTLS
• Python GLIDE mTLS

Implementation Details

The glide-core Rust layer already supports mTLS configuration via protobuf fields:

• bytes client_cert = 22; in connection_request.proto
• bytes client_key = 23; in connection_request.proto

The current PHP TLS struct (valkey_glide_tls_advanced_configuration_t in common.h) only has:
c
typedef struct {
uint8_t* root_certs;
size_t root_certs_len;
bool use_insecure_tls;
} valkey_glide_tls_advanced_configuration_t;

This needs to be extended with:
c
typedef struct {
uint8_t* root_certs;
size_t root_certs_len;
uint8_t* client_cert;
size_t client_cert_len;
uint8_t* client_key;
size_t client_key_len;
bool use_insecure_tls;
} valkey_glide_tls_advanced_configuration_t;

And create_connection_request() in valkey_glide_core_commands.c needs to serialize the new fields into the protobuf message.

Related

• Other GLIDE clients already support mTLS via glide-core
• The Rust core (glide-core) already has mTLS plumbing available
• C# tracking issue: feat(config): add mTLS (mutual TLS) support valkey-glide-csharp#488

Additional Information

• The glide-core Rust layer already supports mTLS configuration, so the primary work is exposing this capability through the C/Zend extension and the PHP public API.
• This should be a non-breaking addition (new optional configuration keys in the tls_config array).
• Integration tests will require a Valkey server configured with mTLS (client certificate verification enabled).
• The existing stream_context_create(['ssl' => ...]) path in the standalone client could also be extended to pass client cert/key, but the advanced_config path is preferred for consistency across standalone and cluster clients.