禁用通用名称验证-Go HTTP Client

Question

How do I disable common name validation inside of a go http client. I am doing mutual TLS with a common CA and hence common name validation means nothing.

The tls docs say,

// ServerName is used to verify the hostname on the returned
// certificates unless InsecureSkipVerify is given. It is also included
// in the client's handshake to support virtual hosting unless it is
// an IP address.
ServerName string

I don't want to do InsecureSkipVerify but I don't want to validate the common name.

Answer 1

You would pass a tls.Config struct with your own VerifyPeerCertificate function, and then you would check the certificate yourself.

VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error

If normal verification fails then the handshake will abort before considering this callback. If normal verification is disabled by setting InsecureSkipVerify then this callback will be considered but the verifiedChains argument will always be nil.

You can look here for an example of how to verify a certificate. Iif you look here, you'll see that part of even this verification process includes checking the hostname, but luckily you'll see that it skips it if it's set to the empty string.

So, basically you write your own VerifyPeerCertificate function, convert the rawCerts [][]byte, which I think would look something like:

customVerify := func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
    roots := x509.NewCertPool()
    for _, rawCert := range rawCerts {
        cert, _ := x509.ParseCertificate(rawCert)
        roots.AddCert(cert)
    }
    opts := x509.VerifyOptions{
        Roots:   roots,
    }
    _, err := cert.Verify(opts)
    return err
}

conf := tls.Config{
    //...
    VerifyPeerCertificate: customVerify,
}