Golang TLS handshake timeout, affecting go get and go code

Question

Golang can no longer complete TLS handshakes on my mac (Catalina, but this issue was present on Mojave first).

I've first noticed that this was occurring with failures to go get :

unrecognized import path "golang.org/x/text": https fetch: Get "https://golang.org/x/text?go-get=1": net/http: TLS handshake timeout

But I've also confirmed that this is affect golang code as well. Here's a basic example I expect to work:

package main

import (
    "fmt"
    "net/http"
)

func main() {
    resp, err := http.Get("https://google.com")
    fmt.Printf("%v, %v\n", resp, err)
}

If I save this file as main.go and run it, I get the same error that I see from go get :

<nil>, Get "https://google.com": net/http: TLS handshake timeout

I can't figure out where I'm going wrong - https sites work fine on my browser, and when I use the Python requests package (or curl) I can access TLS sites just fine. It appears that somehow this is a go-specific failure.

Here's the output of go env for completeness:

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/nickchadwick/Library/Caches/go-build"
GOENV="/Users/nickchadwick/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/nickchadwick/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/l9/r8jjmhm13hvcpwppdt9sklm00000gn/T/go-build865222134=/tmp/go-build -gno-record-gcc-switches -fno-common"

Any hints on solving this would be greatly appreciated! Not being able to go get things is a huge bummer.

Answer 1

After narrowing it down to a macOS problem, this fixed it: clean up the old Keychain Access System Certificates.

Answer 2

I ran into something similar. When I build the binary on Mac without the CGO_ENABLED flag it seems to work. Just adding CGO_ENABLED env var during the build causes this issue.