生成证书

:::info // 生成根证书
openssl genrsa -out ca.key 2048
openssl req -sha256 -new -out ca.csr -key ca.key
openssl x509 -req -sha256 -in ca.csr -out ca.crt -signkey ca.key -CAcreateserial -days 3650

// 生成服务端证书
openssl genrsa -out server.key 2048
openssl req -sha256 -new -out server.csr -key server.key
openssl x509 -req -sha256 -in server.csr -out server.crt -signkey server.key -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650

// 生成客户端证书
openssl genrsa -out client.key 2048
openssl req -sha256 -new -out client.csr -key client.key
openssl x509 -req -sha256 -in client.csr -out client.crt -signkey client.key -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

:::

服务端

  1. package main
  3. import (
  4.     "crypto/tls"
  5.     "crypto/x509"
  6.     "github.com/gin-gonic/gin"
  7.     "io/ioutil"
  8.     "net/http"
  9.     "time"
  10. )
  12. func main() {
  13.     router := gin.Default()
  15.     caCertData, err := ioutil.ReadFile("./ca.crt")
  16.     if err != nil {
  17.         panic(err)
  18.     }
  19.     rootCAs := x509.NewCertPool()
  20.     rootCAs.AppendCertsFromPEM(caCertData)
  22.     s := &http.Server{
  23.         Addr:           ":443",
  24.         Handler:        router,
  25.         ReadTimeout:    10 * time.Second,
  26.         WriteTimeout:   10 * time.Second,
  27.         MaxHeaderBytes: 1 << 20,
  28.         TLSConfig: &tls.Config{
  29.             // 客户端需要提供证书
  30.             ClientAuth: tls.RequireAndVerifyClientCert,
  31.             // 用于验证客户端证书
  32.             ClientCAs:  rootCAs, 
  33.         },
  34.     }
  36.     router.GET("ping", func(context *gin.Context) {
  37.         context.String(200, "%s", "pong")
  38.     })
  39.     //s.ListenAndServe()
  40.     s.ListenAndServeTLS("./server.crt", "./server.key")
  41. }

客户端（失败）

  1. package main
  3. import (
  4.     "crypto/tls"
  5.     "fmt"
  6.     "io"
  7.     "net/http"
  8.     "strconv"
  9. )
  11. func main() {
  12.     client := &http.Client{Transport: &http.Transport{
  13.         TLSClientConfig: &tls.Config{
  14.             InsecureSkipVerify: true,
  15.         },
  16.     }}
  18.     rsp, err := client.Get("https://127.0.0.1:443/ping")
  19.     if err != nil {
  20.         panic(err)
  21.     }
  22.     defer rsp.Body.Close()
  24.     length, err := strconv.Atoi(rsp.Header.Get("Content-Length"))
  25.     if err != nil {
  26.         panic(err)
  27.     }
  28.     var data = make([]byte, length)
  30.     n, err := rsp.Body.Read(data)
  31.     if err != nil && err != io.EOF {
  32.         panic(err)
  33.     }
  35.     fmt.Println(string(data[:n]))
  36. }
  38. ➜  mutual-auth go run client-2.go
  39. panic: Get "https://127.0.0.1:443/ping": remote error: tls: bad certificate

成功

  1. package main
  3. import (
  4.     "crypto/tls"
  5.     "fmt"
  6.     "io"
  7.     "net/http"
  8. )
  10. func main() {
  11.     cert, err := tls.LoadX509KeyPair("client.crt", "client.key")
  12.     if err != nil {
  13.         panic(err)
  14.     }
  16.     tr := &http.Transport{
  17.         TLSClientConfig: &tls.Config{
  18.             // 因为用的是自签名证书，所以要跳过验证
  19.             InsecureSkipVerify: true,
  20.             Certificates:       []tls.Certificate{cert},
  21.         },
  22.     }
  23.     client := &http.Client{Transport: tr}
  25.     rsp, err := client.Get("https://127.0.0.1:443/ping")
  26.     if err != nil {
  27.         panic(err)
  28.     }
  29.     defer rsp.Body.Close()
  31.     var data = make([]byte, 1024)
  33.     n, err := rsp.Body.Read(data)
  34.     if err != nil && err != io.EOF {
  35.         panic(err)
  36.     }
  38.     fmt.Println(string(data[:n]))
  39. }
  41. ➜  mutual-auth go run client-1.go
  42. pong