Fix protected activation ordering and diagnostic review findings

1 files changed, 6 insertions, 2 deletions

diff --git a/src/diagnostics.rs b/src/diagnostics.rs
index a2052ec..432a801 100644
--- a/src/diagnostics.rs
+++ b/src/diagnostics.rs
@@ -18,11 +18,12 @@ pub struct Observation {
     pub retry_after_seconds: Option<u64>,
 }
 
-/// The caller supplies an authenticated, service-owned SOCKS endpoint. This client
+/// The caller supplies an authenticated, service-owned HTTPS proxy endpoint. This client
 /// never inherits environment proxies or creates a direct route to the target.
 pub async fn measure(
     settings: &Settings,
     proxy: &str,
+    certificate: &str,
     id: String,
     generation: u64,
     speed: bool,
@@ -42,11 +43,14 @@ pub async fn measure(
     };
     let proxy =
         reqwest::Proxy::all(proxy).map_err(|_| anyhow!("Invalid protected probe endpoint"))?;
+    let certificate = reqwest::Certificate::from_pem(certificate.as_bytes())
+        .map_err(|_| anyhow!("Invalid private probe certificate"))?;
     let client = reqwest::Client::builder()
         .no_proxy()
         .proxy(proxy)
         .redirect(reqwest::redirect::Policy::none())
-        .timeout(Duration::from_secs(duration))
+        .tls_certs_merge([certificate])
+        .retry(reqwest::retry::never())
         .user_agent(concat!("Roentgen/", env!("CARGO_PKG_VERSION")))
         .build()
         .map_err(|_| anyhow!("Could not initialize diagnostic TLS client"))?;