Question

我正在尝试验证本地根CA颁发的自签名证书。我的应用程序也具有相同的根CA。我正在使用代理服务来访问服务器。代理服务的基本作用是将请求重定向到服务器。下面是我尝试使用的代码

package main

import (
    "net/http"
    "crypto/tls"
    "log"
    "crypto/x509"
    "flag"
)

const localCertFile = `-----BEGIN CERTIFICATE-----
MIIDwzCCAqugAwIBAgIJAI6nmnGw6bGbMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYD
VQQGEwJVUzETMBEGA1UECAwKTmV3IEplcnNleTEWMBQGA1UEBwwNQmFza2luZyBS
aWRnZTESMBAGA1UECgwJQXZheWEgSW5jMQwwCgYDVQQLDANHQ1MxIDAeBgNVBAMM
F2Nsb3VkLXRydXN0Y2EuYXZheWEuY29tMSAwHgYJKoZIhvcNAQkBFhFzdXBwb3J0
QGF2YXlhLmNvbTAeFw0xODA1MjUxMDE2MjNaFw0yODA1MjIxMDE2MjNaMIGgMQsw
CQYDVQQGEwJVUzETMBEGA1UECAwKTmV3IEplcnNleTEWMBQGA1UEBwwNQmFza2lu
ZyBSaWRnZTESMBAGA1UECgwJQXZheWEgSW5jMQwwCgYDVQQLDANHQ1MxIDAeBgNV
BAMMF2Nsb3VkLXRydXN0Y2EuYXZheWEuY29tMSAwHgYJKoZIhvcNAQkBFhFzdXBw
b3J0QGF2YXlhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKJp
sdLWk3S9MefVajUSaEZf4pjo58Z6t3vqvxNaJ1oDBDRuBJZzHv4Grs7SfQFnzRRH
ivZTa6vNHJCaDMds5qztf6BhpyEwwdQdtCCQgiaAIV1HuLA1dnR4iAT2jUH4Pvxt
/BDj60j2YDFfV5j6Fh20lH5sKpkVEftPZ8PClEhqJ286h+U3i96WnTR54FIu6DKU
4RQjp3Cu2an/824HjNSLy5Tgr5N3RrosOJ4cZga9663p0DuIfpkQUvf+uPPafKUO
Ct90QwFpEDrX7jYB1VIy9by4OI/UvZjijCJ4Q/5Xl+SKZLD1gs5/QXSccOSyayEk
7/941MbGqwKjZXcszC8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAihQiDedCG3un
V0TWmo9e4gHkoMfMgeKOEtNLiIFejZjMILyiY9/bv/vemp27WR1tbKz/Mo/zcJbU
oxDyHrEszp4ZYAwK2vFRT1T2r3rIGgUf4XyPSu8fEYLnPeCdm3BFpCrC4jIsaxJ3
BJYvmFUSCLw1IjcgCrBp4lpMRKySjCPpZiisldDBKrJrulNwx7g1I1CYxLn2jkIu
b/uL0SOJPDMriS3UZ0eqByBJTZ57rkVAeW6VUbwXxIBXQX1aC2PIT2n1svywHgY2
HlK5YUaCPPL3C1MiL2Qn9ZIQwcW/eY758polgOQIo6iys9MkG7sdYlpP61V5tZud
6FqDS2taqA==
-----END CERTIFICATE-----`

func main() {
    insecure := flag.Bool("insecure-ssl", false, "Accept/Ignore all server SSL certificates")
    flag.Parse()

    rootCA, _ := x509.SystemCertPool()
    if rootCA == nil {
        rootCA = x509.NewCertPool()
    }
    /*cert, err := ioutil.ReadFile(localCertFile)

    if err != nil {
        log.Fatalf("Failed to append %q to RootCAs: %v", localCertFile, err)
    }*/

    if ok := rootCA.AppendCertsFromPEM([]byte(localCertFile)); !ok {
        log.Println("No certs appended, using system certs only")
    }

    config := &tls.Config{
        InsecureSkipVerify: *insecure,
        RootCAs: rootCA,
        //ServerName: "trust.170918167.comsubjectKeyIdentifier   = hash",
    }

    tr := &http.Transport{TLSClientConfig: config}
    client := &http.Client{Transport: tr}

    req, _ := http.NewRequest(http.MethodGet, "https://cmm-register.default.svc.cluster.local:7070/MediaManager/ws/sysconfig", nil)
    resp, err := client.Do(req)
    if err != nil {
        log.Fatal(err)
    }

    log.Println(resp)




    //Error when ServerName is diabled
            //Get https://service:7070/sysconfig: x509: certificate is valid for trust.170918167.comsubjectKeyIdentifier   = hash, not service
            //When ServerName is set
            //Get https://service:7070/sysconfig: x509: certificate signed by unknown authority (possibly
            //because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "cloud-trustca.test.com")
}

该如何解决此问题，因为我需要使用同一CA来验证服务器证书。当我尝试使用openssl验证服务器证书时，使用相同的根ca对其进行了正确的验证。

当前我正在使用Go v1.9。

Answer 1

我已经看到您已经发布的ca证书存在一些问题，但是如果没有它发出的服务器证书，也很难诊断。上面的SAN名称需要与您的客户端所命中的主机名匹配，看来它们可能不匹配。

查看该证书上的标志（使用this site可以看到），看来ca cert没有设置CA位，因此对于任何子证书都不是有效的颁发者。您需要启用该扩展名的根证书，然后才能从中生成有效证书。

如何验证服务器的自签名证书

1 个答案: