如何配置SSL身份验证

Question

I have certificate.pem that I use to perform client authentication with a remote server. When I access the server, normally Chrome pops up, asks if I want to use that certificate, I say yes, then I'm authenticated. I'm trying to figure out why it's not sending the certificate with the dialer when I call it programmatically:

type DialerHelper func() (io.ReadWriter, error)
func DialIt(addr string, port uint16, config *tls.Config) (Dialer, error) {
    address := fmt.Sprintf("%s:%d", addr, port)
    return DialerHelper(func() (io.ReadWriter, error) {
        return tls.Dial("tcp", address, config)
    }), nil
}
caPool := x509.NewCertPool()
cert, err := ioutil.ReadFile("certificate.pem")
if err != nil {
    panic(err)
}
ok := caPool.AppendCertsFromPEM(cert)
if !ok {
    panic(ok)
}

tlsconfig := &tls.Config{
    InsecureSkipVerify: true,
    RootCAs: caPool, }
tlsconfig.BuildNameToCertificate()
DialIt("some.address.com", 443, tlsconfig)

I keep getting an error from the server saying there is no client certificate supplied. Am I sending the SSL certificate correctly to the remote server? I'm not an expert with SSL.

Edit: this is the functionality I'm trying to replicate: curl -k --cert /home/me/.ssh/certificate.pem

Answer 1

If the server is using a cert generated from your own Certificate Authority, then the following code will do the trick.

I've never tried Client Cert Authentication in an environment where the server cert is from a public CA, so I'm not sure how you'd achieve that. Perhaps just leaving out setting config.RootCAs.

func loadCertificates(caFileName, certFileName, keyFileName string) (tls.Certificate, *x509.CertPool, error) {

    myCert, err := tls.LoadX509KeyPair(certFileName, keyFileName)
    if err != nil {
        return tls.Certificate{}, nil, err
    }

    ca, err := ioutil.ReadFile(caFileName)
    if err != nil {
        return tls.Certificate{}, nil, err
    }

    certPool := x509.NewCertPool()
    if !certPool.AppendCertsFromPEM(ca) {
        return tls.Certificate{}, nil, errors.New("Failed appending certs")
    }

    return myCert, certPool, nil

}


func GetClientTlsConfiguration(caFileName, certFileName, keyFileName string) (*tls.Config, error) {
    config := &tls.Config{}
    myCert, certPool, err := loadCertificates(caFileName, certFileName, keyFileName)
    if err != nil {
        return nil, err
    }
    config.Certificates = make([]tls.Certificate, 1)
    config.Certificates[0] = myCert

    config.RootCAs = certPool
    config.ClientCAs = certPool

    return config, nil

}


tlsConfig, err := config.GetClientTlsConfiguration("ca.crt", "client.crt", "client.key")

if err != nil {
    log.Fatalf("Error loading tls config - %v", err)
}

client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}

client.Get(.....)