[FEATURE]: Add first-class mTLS client certificate support for HTTPS/MCP/provider connections

[cruzanstx]

• I have verified this feature I'm about to request hasn't been suggested before.

Summary

OpenCode should support first-class mutual TLS (mTLS) for outbound HTTPS connections, including provider API calls and remote MCP servers that require client certificate authentication.

Today, users can set custom CA trust (NODE_EXTRA_CA_CERTS), but there is no clear first-class config path for client cert + key (and optional CA) across relevant network surfaces.

Why this matters

Many enterprise environments require mTLS for:

• outbound API access through secure gateways
• internal MCP endpoints
• zero-trust service-to-service access

Without mTLS support, OpenCode is difficult to use in regulated/corporate environments.

Proposed config

Add explicit config options (names are examples):

{
  "network": {
    "mtls": {
      "cert": "/path/client-cert.pem",
      "key": "/path/client-key.pem",
      "ca": "/path/ca.pem",
      "passphrase": "{env:MTLS_KEY_PASSPHRASE}"
    }
  }
}

And/or allow per-target overrides, e.g. per provider or per MCP server.

Expected behavior

• OpenCode can establish HTTPS connections that require client cert authentication.
• mTLS config is supported in:
  • provider requests
  • remote MCP HTTP/SSE transport
  • other outbound HTTPS flows used by OpenCode
• Failure messages are actionable (missing cert/key, invalid format, handshake failure, etc.).
• Paths and secrets are not logged in plaintext.

Acceptance criteria

• Documented config schema for mTLS cert/key/ca
• Works for at least provider and remote MCP connections
• Works with PEM cert+key files
• Clear troubleshooting docs for TLS handshake failures
• Tests covering success and common failure cases

[github-actions]

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

• The title should start with [FEATURE]: (currently uses "Feature:" without the required bracket format)
• Feature requests require a verification checkbox confirming you've searched for existing issues

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[cruzanstx]

Updated per template requirements: title now uses and the verification checkbox is included at the top.

[cruzanstx]

Correction: title now uses [FEATURE]: prefix and the required verification checkbox is included at the top.

[github-actions]

Thanks for updating the issue! It now follows the contributing guidelines and feature request template. We appreciate the clear description of the use case and proposed config. The team will review it.