如何让 Go 接受用于 TLS 客户端身份验证的自签名证书?
How can I make Go accept a self-signed certificate for TLS client authentication?
我正在使用 AWS API 网关和 Go 后端。为了确保所有连接都通过 API 网关,我需要使用 TLS 客户端身份验证(又名双向身份验证,相互身份验证)。
原则上,这适用于:
func enableClientAuth(server *http.Server, clientCertFile string) error {
clientCert, err := ioutil.ReadFile(clientCertFile)
if err != nil {
return err
}
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(clientCert)
tlsConfig := &tls.Config{
ClientAuth: tls.RequireAndVerifyClientCert,
ClientCAs: caCertPool,
}
tlsConfig.BuildNameToCertificate()
server.TLSConfig = tlsConfig
return nil
}
我遇到的问题是这个错误:
tls: failed to verify client's certificate: x509: certificate signed by unknown authority (possibly because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "ApiGateway")
这好像是因为客户端证书是自签名的,但不是CA证书,Go不接受签名。 (这不是违背了自签名证书的目的吗?我见过的大多数自签名证书都不是 CA 证书。)不幸的是,我无法控制客户端证书的生成或发送方式;这一切都由 AWS 完成。我可以做些什么来在 ClientCAs 证书池中获取证书,这将使 Go 接受 API 网关客户端证书?
示例客户端证书:
-----BEGIN CERTIFICATE-----
MIIC6DCCAdCgAwIBAgIISIIYdm+rIgMwDQYJKoZIhvcNAQELBQAwNDELMAkGA1UE
BhMCVVMxEDAOBgNVBAcTB1NlYXR0bGUxEzARBgNVBAMTCkFwaUdhdGV3YXkwHhcN
MTYwMzMwMTgxNTE4WhcNMTcwMzMwMTgxNTE4WjA0MQswCQYDVQQGEwJVUzEQMA4G
A1UEBxMHU2VhdHRsZTETMBEGA1UEAxMKQXBpR2F0ZXdheTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBALVVG0Ng8IbDy0tdw2yp2GHXYV8jDPJxsRXAstZ+
5N4ngG/ySPyv1i2OOvzKqUNzyKptsUbgtG/0XDWRI0qDATrsxXH6xy8lBeRZHNi4
ko6EP9BevyxB5YtoKqEoXbKAn4/hNWmac8tnENkLww0qFpPOhtxb0B2DHv+lkqZo
qBBBBZQ5Dal95h0cpUwoLRr5w3HsYzPcX1OUtQ/5cH0M0p/XvkB4jrZxsh1aQGsf
B9+temIJJtKvmmZ0C/dZ+neJhA+I526eUENeqmm5R1irM7sj4FDaU4bLR+L/+R6s
KtDLT4jPqf5vFYfMuEmyk4b5TBATJxAA47Y+gRFRe6Aon0ECAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAmFdXuy5Y6zdrIZHd7XCt/Q6jsU3hFGaEGRbDEFBwh6ixz58e
1egiUnIeUWZTFSzjQSY3IhYE7dvW+BVkjdLybhB3rim29Fb67AkBtRmQOLnHz426
bflOG46BSwNTvIEytOr0O6ds49bD34UrHELUCGmHJqIhBSrVCFOCwlf/Mksw9jxD
xo/YmJe2R4xNklvxWiFHOXrnGwrJ9yaWeQnCkRZBzfFLSZ26/fBnbkYUGn0lmtoB
e/rg/rgpwufbkhXA6CFX7adnLUKWqZgbmL5dpvLu9vB34ebfo4vE+o7AsgdloHBV
obcSyrLbZp25k/SlbOhSAqjjW1NaF+YypTxHFA==
-----END CERTIFICATE-----
@JohnWeldon 的评论让我找到了解决方案,即我需要在加载后修改客户端证书结构。这需要解码 PEM 并解析出证书。对于 API 网关客户端证书,我必须将 BasicConstraintsValid
和 IsCA
设置为 true,将 KeyUsage
设置为 KeyUsageCertSign
;对于我本地生成的证书,我只需要后两个。修改我问题中的 enableClientAuth()
函数:
func enableClientAuth(server *http.Server, clientCertFile string) error {
pemBytes, err := ioutil.ReadFile(clientCertFile)
if err != nil {
return err
}
pemBlock, _ := pem.Decode(pemBytes)
clientCert, err := x509.ParseCertificate(pemBlock.Bytes)
if err != nil {
return err
}
clientCert.BasicConstraintsValid = true
clientCert.IsCA = true
clientCert.KeyUsage = x509.KeyUsageCertSign
caCertPool := x509.NewCertPool()
caCertPool.AddCert(clientCert)
tlsConfig := &tls.Config{
ClientAuth: tls.RequireAndVerifyClientCert,
ClientCAs: caCertPool,
}
tlsConfig.BuildNameToCertificate()
server.TLSConfig = tlsConfig
return nil
}
我正在使用 AWS API 网关和 Go 后端。为了确保所有连接都通过 API 网关,我需要使用 TLS 客户端身份验证(又名双向身份验证,相互身份验证)。
原则上,这适用于:
func enableClientAuth(server *http.Server, clientCertFile string) error {
clientCert, err := ioutil.ReadFile(clientCertFile)
if err != nil {
return err
}
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(clientCert)
tlsConfig := &tls.Config{
ClientAuth: tls.RequireAndVerifyClientCert,
ClientCAs: caCertPool,
}
tlsConfig.BuildNameToCertificate()
server.TLSConfig = tlsConfig
return nil
}
我遇到的问题是这个错误:
tls: failed to verify client's certificate: x509: certificate signed by unknown authority (possibly because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "ApiGateway")
这好像是因为客户端证书是自签名的,但不是CA证书,Go不接受签名。 (这不是违背了自签名证书的目的吗?我见过的大多数自签名证书都不是 CA 证书。)不幸的是,我无法控制客户端证书的生成或发送方式;这一切都由 AWS 完成。我可以做些什么来在 ClientCAs 证书池中获取证书,这将使 Go 接受 API 网关客户端证书?
示例客户端证书:
-----BEGIN CERTIFICATE-----
MIIC6DCCAdCgAwIBAgIISIIYdm+rIgMwDQYJKoZIhvcNAQELBQAwNDELMAkGA1UE
BhMCVVMxEDAOBgNVBAcTB1NlYXR0bGUxEzARBgNVBAMTCkFwaUdhdGV3YXkwHhcN
MTYwMzMwMTgxNTE4WhcNMTcwMzMwMTgxNTE4WjA0MQswCQYDVQQGEwJVUzEQMA4G
A1UEBxMHU2VhdHRsZTETMBEGA1UEAxMKQXBpR2F0ZXdheTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBALVVG0Ng8IbDy0tdw2yp2GHXYV8jDPJxsRXAstZ+
5N4ngG/ySPyv1i2OOvzKqUNzyKptsUbgtG/0XDWRI0qDATrsxXH6xy8lBeRZHNi4
ko6EP9BevyxB5YtoKqEoXbKAn4/hNWmac8tnENkLww0qFpPOhtxb0B2DHv+lkqZo
qBBBBZQ5Dal95h0cpUwoLRr5w3HsYzPcX1OUtQ/5cH0M0p/XvkB4jrZxsh1aQGsf
B9+temIJJtKvmmZ0C/dZ+neJhA+I526eUENeqmm5R1irM7sj4FDaU4bLR+L/+R6s
KtDLT4jPqf5vFYfMuEmyk4b5TBATJxAA47Y+gRFRe6Aon0ECAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAmFdXuy5Y6zdrIZHd7XCt/Q6jsU3hFGaEGRbDEFBwh6ixz58e
1egiUnIeUWZTFSzjQSY3IhYE7dvW+BVkjdLybhB3rim29Fb67AkBtRmQOLnHz426
bflOG46BSwNTvIEytOr0O6ds49bD34UrHELUCGmHJqIhBSrVCFOCwlf/Mksw9jxD
xo/YmJe2R4xNklvxWiFHOXrnGwrJ9yaWeQnCkRZBzfFLSZ26/fBnbkYUGn0lmtoB
e/rg/rgpwufbkhXA6CFX7adnLUKWqZgbmL5dpvLu9vB34ebfo4vE+o7AsgdloHBV
obcSyrLbZp25k/SlbOhSAqjjW1NaF+YypTxHFA==
-----END CERTIFICATE-----
@JohnWeldon 的评论让我找到了解决方案,即我需要在加载后修改客户端证书结构。这需要解码 PEM 并解析出证书。对于 API 网关客户端证书,我必须将 BasicConstraintsValid
和 IsCA
设置为 true,将 KeyUsage
设置为 KeyUsageCertSign
;对于我本地生成的证书,我只需要后两个。修改我问题中的 enableClientAuth()
函数:
func enableClientAuth(server *http.Server, clientCertFile string) error {
pemBytes, err := ioutil.ReadFile(clientCertFile)
if err != nil {
return err
}
pemBlock, _ := pem.Decode(pemBytes)
clientCert, err := x509.ParseCertificate(pemBlock.Bytes)
if err != nil {
return err
}
clientCert.BasicConstraintsValid = true
clientCert.IsCA = true
clientCert.KeyUsage = x509.KeyUsageCertSign
caCertPool := x509.NewCertPool()
caCertPool.AddCert(clientCert)
tlsConfig := &tls.Config{
ClientAuth: tls.RequireAndVerifyClientCert,
ClientCAs: caCertPool,
}
tlsConfig.BuildNameToCertificate()
server.TLSConfig = tlsConfig
return nil
}