【实践】如何在本地环境用GO实现HTTPS链接？

[root@iZ23prr3ucfZ server]# curl --cacert cert.pem  https://localhost
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

这是成功的命令输出结果：
[root@iZ23prr3ucfZ tmp]# git clone https://github.com/michaelklishin/tls-gen
Initialized empty Git repository in /root/tmp/tls-gen/.git/
remote: Enumerating objects: 369, done.
remote: Total 369 (delta 0), reused 0 (delta 0), pack-reused 369
Receiving objects: 100% (369/369), 90.46 KiB | 117 KiB/s, done.
Resolving deltas: 100% (215/215), done.
[root@iZ23prr3ucfZ tmp]# ls
server.crt  server.csr  server.go  server.key  tls-gen
[root@iZ23prr3ucfZ tmp]# cd tls-gen/basic
[root@iZ23prr3ucfZ basic]# make CN=localhost
python3 profile.py regenerate --password "" \
    --common-name localhost \
    --client-alt-name iZ23prr3ucfZ \
    --server-alt-name iZ23prr3ucfZ \
    --days-of-validity 3650 \
    --key-bits 2048 
Removing /root/tmp/tls-gen/basic/testca
Removing /root/tmp/tls-gen/basic/result
Removing /root/tmp/tls-gen/basic/server
Removing /root/tmp/tls-gen/basic/client
Will generate a root CA and two certificate/key pairs (server and client)
=>  [openssl_req]
Generating a 2048 bit RSA private key
..................................+++
.............................................................+++
writing new private key to '/root/tmp/tls-gen/basic/testca/private/cakey.pem'
-----
=>  [openssl_x509]
Will generate leaf certificate and key pair for server
Using localhost for Common Name (CN)
Using parent certificate path at /root/tmp/tls-gen/basic/testca/cacert.pem
Using parent key path at /root/tmp/tls-gen/basic/testca/private/cakey.pem
Will use RSA...
=>  [openssl_genrsa]
Generating RSA private key, 2048 bit long modulus
............................................+++
...............................................................................................+++
e is 65537 (0x10001)
=>  [openssl_req]
=>  [openssl_ca]
Using configuration from /tmp/tmpdaabupsr
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'localhost'
organizationName      :PRINTABLE:'server'
localityName          :T61STRING:'$$$$'
Certificate is to be certified until May  6 06:24:49 2029 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
Will generate leaf certificate and key pair for client
Using localhost for Common Name (CN)
Using parent certificate path at /root/tmp/tls-gen/basic/testca/cacert.pem
Using parent key path at /root/tmp/tls-gen/basic/testca/private/cakey.pem
Will use RSA...
=>  [openssl_genrsa]
Generating RSA private key, 2048 bit long modulus
..............+++
............+++
e is 65537 (0x10001)
=>  [openssl_req]
=>  [openssl_ca]
Using configuration from /tmp/tmpdaabupsr
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'localhost'
organizationName      :PRINTABLE:'client'
localityName          :T61STRING:'$$$$'
Certificate is to be certified until May  6 06:24:49 2029 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
Done! Find generated certificates and private keys under ./result!
python3 profile.py verify
Will verify generated certificates against the CA...
Will verify client certificate against root CA
/root/tmp/tls-gen/basic/result/client_certificate.pem: OK
Will verify server certificate against root CA
/root/tmp/tls-gen/basic/result/server_certificate.pem: OK

 package main

 import (
    "log"
    "net/http"
 )

 func HelloServer(w http.ResponseWriter, req *http.Request) {
    w.Header().Set("Content-Type", "text/plain")
    w.Write([]byte("This is an example server.\n"))
}

func main() {
    http.HandleFunc("/hello", HelloServer)
    err := http.ListenAndServeTLS(":1443", "server/cert.pem", "server/key.pem", nil)
    if err != nil {
        log.Fatal("ListenAndServe: ", err)
    }
}

package main

import (
    "net/http"
    "fmt"
    "io/ioutil"
    "strings"
)

func main() {
    client := &http.Client{}
    resp, err := client.Get("https://localhost:1443/hello")
    if err != nil {
        panic("failed to connect: " + err.Error())
    }
    content, _ := ioutil.ReadAll(resp.Body)
    s := strings.TrimSpace(string(content))

    fmt.Println(s)
}

panic: failed to connect: Get https://www.mytestdomain.io:1443/hello: x509: certificate signed by unknown authorit

This is an example server.

package main

import (
    "net/http"
    "fmt"
    "io/ioutil"
    "strings"
    "crypto/x509"
    "crypto/tls"
)

func main() {

    rootPEM, err := ioutil.ReadFile("testca/cacert.pem")
    if err != nil {
        fmt.Print(err)
    }

    roots := x509.NewCertPool()
    ok := roots.AppendCertsFromPEM(rootPEM)
    if !ok {
        panic("failed to parse root certificate")
    }

    tr := &http.Transport{
        TLSClientConfig: &tls.Config{RootCAs: roots},
    }

    client := &http.Client{Transport: tr}
    
    resp, err := client.Get("https://localhost:1443/hello")
    if err != nil {
        panic("failed to connect: " + err.Error())
    }
    content, _ := ioutil.ReadAll(resp.Body)
    s := strings.TrimSpace(string(content))

    fmt.Println(s)
}

This is an example server.