如何使Go接受用于TLS客户端身份验证的自签名证书？

问题描述：

I'm working with AWS API Gateway and a Go back end. In order to ensure all connections are going through API Gateway, I need to use TLS client authentication (aka two-way authentication, mutual authentication).

In principle, this works with something like:

func enableClientAuth(server *http.Server, clientCertFile string) error {
    clientCert, err := ioutil.ReadFile(clientCertFile)
    if err != nil {
        return err
    }
    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(clientCert)

    tlsConfig := &tls.Config{
        ClientAuth: tls.RequireAndVerifyClientCert,
        ClientCAs:  caCertPool,
    }
    tlsConfig.BuildNameToCertificate()
    server.TLSConfig = tlsConfig
    return nil
}

The problem I'm having is this error:

tls: failed to verify client's certificate: x509: certificate signed by unknown authority (possibly because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "ApiGateway")

This seems to be because the client certificate is self-signed, but is not a CA certificate, Go will not accept the signature. (Doesn't this defeat the purpose of a self-signed certificate? Most self-signed certs I have seen are not CA certs.) Unfortunately, I have no control over how the client certificate is generated or sent; it is all done by AWS. Is there something I can do to get a certificate in the ClientCAs cert pool that will cause Go to accept the API Gateway client certificate?

Example client certificate:

答

@JohnWeldon's comment led me to the solution, which is that I need to modify the client Certificate struct after I load it. This requires decoding the PEM and parsing out the certificate. For the API Gateway client certificate, I had to set BasicConstraintsValid and IsCA to true and KeyUsage to KeyUsageCertSign; for my locally generated cert I only needed the latter two. Modifying the enableClientAuth() func in my question:

func enableClientAuth(server *http.Server, clientCertFile string) error {
    pemBytes, err := ioutil.ReadFile(clientCertFile)
    if err != nil {
        return err
    }

    pemBlock, _ := pem.Decode(pemBytes)
    clientCert, err := x509.ParseCertificate(pemBlock.Bytes)
    if err != nil {
        return err
    }

    clientCert.BasicConstraintsValid = true
    clientCert.IsCA = true
    clientCert.KeyUsage = x509.KeyUsageCertSign

    caCertPool := x509.NewCertPool()
    caCertPool.AddCert(clientCert)

    tlsConfig := &tls.Config{
        ClientAuth: tls.RequireAndVerifyClientCert,
        ClientCAs:  caCertPool,
    }
    tlsConfig.BuildNameToCertificate()
    server.TLSConfig = tlsConfig
    return nil
}

如何使Go接受用于TLS客户端身份验证的自签名证书？

相关推荐