23

I have a cert file, that location is: /usr/abc/my.crt and I want to use that cert for my tls config, so that my http client uses that certificate when communicate with other servers. My current code is as follows:

mTLSConfig := &tls.Config {
    CipherSuites: []uint16 {
        tls.TLS_RSA_WITH_RC4_128_SHA,
        tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
        tls.TLS_RSA_WITH_AES_128_CBC_SHA,
        tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
        tls.TLS_RSA_WITH_AES_128_CBC_SHA,
        tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
    }
}

mTLSConfig.PreferServerCipherSuites = true
mTLSConfig.MinVersion = tls.VersionTLS10
mTLSConfig.MaxVersion = tls.VersionTLS10

tr := &http.Transport{
    TLSClientConfig: mTLSConfig,
}

c := &http.Client{Transport: tr}

So how to assign a certificate in my TLS config? I see the certificate settings at http://golang.org/pkg/crypto/tls/#Config can someone suggest how to config my cert location there?

mTLSConfig.Config{Certificates: []tls.Certificate{'/usr/abc/my.crt'}} <-- is wrong because I am passing string.right? I DON'T have ANY other files such as .pem or .key etc, just only this my.cert. I am blank how to do it?

Earlier, I had edited the go source code http://golang.org/src/pkg/crypto/x509/root_unix.go and added /usr/abc/my.crt after line no. 12 and it worked. But the problem is my certificate file location can change, so I have removed the hardcoded line from root_unix.go and trying to pass it dynamically, when building TLSConfig.

1 Answer 1

28

You can replace the system CA set by providing a root CA pool in tls.Config.

certs := x509.NewCertPool()

pemData, err := ioutil.ReadFile(pemPath)
if err != nil {
    // do error
}
certs.AppendCertsFromPEM(pemData)
mTLSConfig.RootCAs = certs

If you still want the system's roots however, I think you'll need to recreate the functionality in initSystemRoots(). I don't see any exposed method for merging a cert into the default system roots.

7
  • Thank @JimB , but this does not solve the problem. As you are sugegsting to pass pemData, while I have file path. I stumbled upon gist.github.com/spikebike/2232102 but there it is using LoadX509KeyPair while I have ONLY ONE cert file
    – JVK
    Feb 4, 2014 at 22:02
  • @JVK I don't understand your comment. I'll add some code to be more explicit.
    – JimB
    Feb 4, 2014 at 22:06
  • Thanks @JimB, this is the simplest way to use a pem file. Do we have any method to use a pass-phrase along with this?
    – Manu
    Apr 17, 2015 at 12:52
  • @Manu: I don't understand. This answer is about adding a CA. There's no private key involved, so you don't need a passphrase.
    – JimB
    Apr 17, 2015 at 13:00
  • Sorry if I am writing in a wrong context. I was tring to connect to apple push notification service with a pem file. My code look likes below. I have to use a passphrase along with the pem file. certs := x509.NewCertPool() pemData, err := ioutil.ReadFile("pemfile.pem") if err != nil { // do error } certs.AppendCertsFromPEM(pemData) mTLSConfig.ClientCAs = certs cacerts := x509.NewCertPool() pemData2, err := ioutil.ReadFile("cacertificate.pem") if err != nil { // do error } cacerts.AppendCertsFromPEM(pemData2) mTLSConfig.RootCAs = cacerts
    – Manu
    Apr 17, 2015 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.