SSL：GAE / Go上的CERTIFICATE_VERIFY_FAILED

Question

I am developing GAE/Go application and trying to connect Google Big Query from local development server.

My code is like this.

import (
  "cloud.google.com/go/bigquery"
  "golang.org/x/net/context"
  "google.golang.org/api/option"
  gaeLog "google.golang.org/appengine/log"
  newappengine "google.golang.org/appengine"
)

func MyFunc(c *gin.Context) {
  r := c.Request
  ctx := newappengine.NewContext(r)
  client, err := bigquery.NewClient(ctx, PROJECT_ID, option.WithServiceAccountFile(SERVICE_ACCOUNT_JSON_FILE_PATH))
  if err != nil {
      (Error Handling)
  }

  tableList := client.Dataset(DATASET_ID).Tables(ctx)
  for {
    v, err := tableList.Next()
    if err == iterator.Done {
        break
    } else if err != nil {
        gaeLog.Errorf(ctx, "Failed to get meta-info: %v", err)
        return
    }
    :
  }
}

I invoked local development server with goapp.bat serve command. When I posted a request, I got an error.

api_dev.go:344: ERROR: Failed to get meta-info: Get https://www.googleapis.com/bigquery/v2/projects/myproject/datasets/mydataset/tables?alt=json&pageToken=: oauth2: cannot fetch token: Post https://accounts.google.com/o/oauth2/token: API error 6 (urlfetch: SSL_CERTIFICATE_ERROR): [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)

I googled "CERTIFICATE_VERIFY_FAILED", but all I can find is python program. My application is GAE/Go program.

How can I avoid this error?

Answer 1

This is because Google has updated their server certificates but have not notified the Go SDK team of this, which still has the old certs.

The solution seems fairly simple.

1. Go to google_appengine\lib\cacerts\
2. Rename cacerts.txt to cacerts.txt.old, and urlfetch_cacerts.txt to urlfetch_cacerts.txt.old
3. Download the Python Linux SDK 1.9.52.
4. In this Python SDK there's also google_appengine\lib\cacerts\ directory with those two cert files. Copy them over to your Go SDK.
5. Rejoice! You now have newer certs.