dongping1689 2018-02-18 19:09
浏览 293

客户端TLS认证问题

I have issue with client authentication via certificate in GoLang. From trace I see that server is requesting certificate but certificate is not send in client response.

enter image description here

Here is my Go code:

package main

import (
    "bytes"
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
)

func main() {

    xml := `
    <Packet>
<Header>
 <ID>1231232132132354234</ID>
 </Header>
 <Body>
 <Item>
 <Content>SMS</Content>
 <Phone_no>+123123213</Phone_no>
 <Content>test</Content>
 <OriginAddress>Posiljatelj</OriginAddress>
 </Item>
 </Body>
</Packet>
    `

    // Load client cert
    cert, err := tls.LoadX509KeyPair("../cert/certNEW.pem", "../cert/serverNEW.key")
    if err != nil {
        log.Fatal(err)
    }

    // Load CA cert
    caCert, err := ioutil.ReadFile("../cert/cacerts.cer")
    if err != nil {
        log.Fatal(err)
    }
    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(caCert)

    // Setup HTTPS client
    tlsConfig := &tls.Config{
        Certificates:       []tls.Certificate{cert},
        RootCAs:            caCertPool,
        InsecureSkipVerify: true,
    }

    tlsConfig.BuildNameToCertificate()
    transport := &http.Transport{TLSClientConfig: tlsConfig}
    client := &http.Client{Transport: transport}

    resp, err := client.Post("https://api.url", "text/xml", bytes.NewBuffer([]byte(xml)))

    if err != nil {
        fmt.Println(err)
    }
    contents, err := ioutil.ReadAll(resp.Body)
    fmt.Printf("%s
", string(contents))
}

I got pfx certificate from client, what i did is that I extraceted public client certificate, private certificate and rootRA public part and I assrted in Go code.

  • 写回答

1条回答 默认 最新

  • dongye1934 2018-02-18 23:56
    关注

    You need to disable InsecureSkipVerify by setting InsecureSkipVerify: false,

    It causes the chain arguments to be nil https://golang.org/pkg/crypto/tls/

      // If normal verification is disabled by
        // setting InsecureSkipVerify, or (for a server) when ClientAuth is
        // RequestClientCert or RequireAnyClientCert, then this callback will
        // be considered but the verifiedChains argument will always be nil.
    
    评论

报告相同问题?

悬赏问题

  • ¥15 matlab 用yalmip搭建模型,cplex求解,线性化处理的方法
  • ¥15 qt6.6.3 基于百度云的语音识别 不会改
  • ¥15 关于#目标检测#的问题:大概就是类似后台自动检测某下架商品的库存,在他监测到该商品上架并且可以购买的瞬间点击立即购买下单
  • ¥15 神经网络怎么把隐含层变量融合到损失函数中?
  • ¥15 lingo18勾选global solver求解使用的算法
  • ¥15 全部备份安卓app数据包括密码,可以复制到另一手机上运行
  • ¥20 测距传感器数据手册i2c
  • ¥15 RPA正常跑,cmd输入cookies跑不出来
  • ¥15 求帮我调试一下freefem代码
  • ¥15 matlab代码解决,怎么运行