dslkchyv673627 2019-07-31 10:02
浏览 782

TLS客户端服务器的证书链验证,无需服务器名验证

Is it possible to do server's certificate chain verification without verifying servername in Go TLS client from crypto/tls package?

As shown in the below code snippet, if we don't provide any servername we get error like

tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config

rootCA := x509.NewCertPool()
caCert, _ := ioutil.ReadFile("/path/to/ca_cert.pem")
rootCA.AppendCertsFromPEM(caCert)

tlsConfig = tls.Config{
    RootCAs:    rootCA,
    ServerName: "xyz.com",
}

conn, _ := net.Dial("tcp", "ip:port")

c := tls.Client(conn, &tlsConfig)
c.Handshake()

I have a requirement where only server's certificate chain verification is required and servername verification not needed but with Go's crypto/tls package both verification is coupled as an unit.

  • 写回答

0条回答 默认 最新

    报告相同问题?

    悬赏问题

    • ¥60 版本过低apk如何修改可以兼容新的安卓系统
    • ¥25 由IPR导致的DRIVER_POWER_STATE_FAILURE蓝屏
    • ¥50 有数据,怎么建立模型求影响全要素生产率的因素
    • ¥50 有数据,怎么用matlab求全要素生产率
    • ¥15 TI的insta-spin例程
    • ¥15 完成下列问题完成下列问题
    • ¥15 C#算法问题, 不知道怎么处理这个数据的转换
    • ¥15 YoloV5 第三方库的版本对照问题
    • ¥15 请完成下列相关问题!
    • ¥15 drone 推送镜像时候 purge: true 推送完毕后没有删除对应的镜像,手动拷贝到服务器执行结果正确在样才能让指令自动执行成功删除对应镜像,如何解决?