如何在Go中访问客户的证书？

Question

Below is my code for an HTTPS server in Go. The server requires the client to provide an SSL certificate, but doesn't verify the certificate (by design).

You can generate a private/public key pair as follows if you'd like to give it a try:

$ openssl genrsa -out private.pem 2048
$ openssl req -new -x509 -key private.pem -out public.pem -days 365

Does anyone know how I can access the client certificate in the handler? Let's say I would like to report some properties about the certificate the client presented back to the client.

Thanks, Chris.

package main

import (
    "fmt"
    "crypto/tls"
    "net/http"
)

const (
    PORT       = ":8443"
    PRIV_KEY   = "./private.pem"
    PUBLIC_KEY = "./public.pem"
)

func rootHandler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprint(w, "Nobody should read this.")
}

func main() {

    server := &http.Server{
        TLSConfig: &tls.Config{
            ClientAuth: tls.RequireAnyClientCert,
            MinVersion: tls.VersionTLS12,
        },
        Addr: "127.0.0.1:8443",
    }

    http.HandleFunc("/", rootHandler)
    err := server.ListenAndServeTLS(PUBLIC_KEY, PRIV_KEY)
    if err != nil {
        fmt.Printf("main(): %s
", err)
    }
}

Answer 1

Seems r *http.Request has TLS *tls.ConnectionState field which in turn has PeerCertificates []*x509.Certificate field, so

fmt.Fprint(w, r.TLS.PeerCertificates)

probably can do