将证书添加到 REST 调用中

huangapple
go评论119阅读模式
英文:

Adding certificate to a rest call

问题

我正在进行REST API调用以获取一些数据，但是我得到了以下错误信息：

Post "https://url:8200/v1/login": x509: certificate signed by unknown authority

然后我尝试了以下修改后发送crt证书：

  1. certPath := "path/certficate.crt"
  2. cert, crtErr := ioutil.ReadFile(certPath)
  3. if crtErr != nil {
  4.     //
  5. }
  6. //var crtErr error
  7. tp := http.DefaultTransport.(*http.Transport).Clone()
  8. if tp.TLSClientConfig.RootCAs, crtErr = x509.SystemCertPool(); crtErr != nil {
  9.     //error
  10. }
  11. if tp.TLSClientConfig.RootCAs == nil {
  12.     tp.TLSClientConfig.RootCAs = x509.NewCertPool()
  13. }
  14. if tp.TLSClientConfig.RootCAs == nil {
  15.     // error msg
  16. }	 
  17. caCertPool, crtErr := x509.SystemCertPool()
  18. if crtErr != nil {
  19.     //error
  20. }
  21. if tp.TLSClientConfig.RootCAs == nil {
  22.     caCertPool = x509.NewCertPool()
  23. }
  24. caCertPool.AppendCertsFromPEM(cert)
  25. client := &http.Client{
  26.     Transport: &http.Transport{
  27.         TLSClientConfig: &tls.Config{
  28.             ClientCAs: caCertPool,
  29.             // tried this too	RootCAs: caCertPool},
  30.         },
  31.     },
  32. }
  33. // Due to security reason  below code is not reommended.
  34. // this works if added.
  35. //	tr := &http.Transport{}
  36. //TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
  37. //}
  39. var jsonByte *bytes.Buffer
  40.      
  41. jsonByte = bytes.NewBuffer(payloadMap)
  42. req, err := http.NewRequest(httpMethod, url, jsonByte) // URL-encoded payload
  43.      
  44. if err != nil {
  45.     // error
  46. }
  47. req.Header.Add("Content-Type", "application/json")
  48. if headerData != "" {
  49.     req.Header.Add("X-Vault-Token", headerData)
  50. }
  51. resp, errr := client.Do(req)

这并没有解决问题，我尝试使用以下命令通过Docker文件生成crt证书，但由于交互式命令运行，它也没有起作用：

  1. openssl genrsa -out rootCA.key 4096
  2. openssl req -x509 -new -key rootCA.key -days 3650 -out rootCA.crt

需要解决以下错误：Post "https://url:8200/v1/login": x509: certificate signed by unknown authority。

#golang #dockeriamge #vaultrestapi-integration

英文:

I am making rest api call to fetch some data but I am getting

  1.  Post \"https://url:8200/v1/login\": x509: certificate signed by unknown authority]

then I started sending crt with below modification

<!-- begin snippet: js hide: false console: true babel: false -->

<!-- language: lang-html -->

  1. certPath := &quot;path/certficate.crt&quot;
  2. cert, crtErr := ioutil.ReadFile(certPath)
  3. if crtErr != nil {
  4. //
  5. }
  6. //var crtErr error
  7. tp := http.DefaultTransport.(*http.Transport).Clone()
  8. if tp.TLSClientConfig.RootCAs, crtErr = x509.SystemCertPool(); crtErr != nil {
  9. //error
  10. }
  11. if tp.TLSClientConfig.RootCAs == nil {
  12. tp.TLSClientConfig.RootCAs = x509.NewCertPool()
  13. }
  14. if tp.TLSClientConfig.RootCAs == nil {
  15. // error msg
  16. }	 
  17. caCertPool, crtErr := x509.SystemCertPool()
  18. if crtErr != nil {
  19. //error
  20. }
  21. if tp.TLSClientConfig.RootCAs == nil {
  22. caCertPool = x509.NewCertPool()
  23. }
  24. caCertPool.AppendCertsFromPEM(cert)
  25. client := &amp;http.Client{
  26. Transport: &amp;http.Transport{
  27. TLSClientConfig: &amp;tls.Config{
  28. ClientCAs: caCertPool,
  29. // tried this too	RootCAs: caCertPool},
  30. },
  31. },
  32. }
  33. // Due to security reason  below code is not reommended.
  34. // this works if added.
  35. //	tr := &amp;http.Transport{}
  36. //TLSClientConfig: &amp;tls.Config{InsecureSkipVerify: true},
  37. //}
  38. var jsonByte *bytes.Buffer
  39. jsonByte = bytes.NewBuffer(payloadMap)
  40. req, err := http.NewRequest(httpMethod, url, jsonByte) // URL-encoded payload
  41. if err != nil {
  42. // error
  43. }
  44. req.Header.Add(&quot;Content-Type&quot;, &quot;application/json&quot;)
  45. if headerData != &quot;&quot; {
  46. req.Header.Add(&quot;X-Vault-Token&quot;, headerData)
  47. }
  48. resp, errr := client.Do(req)

<!-- end snippet -->

This is not helping, I did try generating crt via docker file using below command
due to the interactive command run, it didn't work either

  1. openssl genrsa -out rootCA.key 4096
  2. openssl req -x509 -new -key rootCA.key -days 3650 -out rootCA.crt

Need to resolve this Post &quot;https://url:8200/v1/login&quot;: x509: certificate signed by unknown authority] .

#golang #dockeriamge #vaultrestapi-integration

答案1

得分: 2

你正在遇到的客户端错误（certificate signed by unknown authority）与客户端不信任服务器有关，与你的客户端证书逻辑无关（我将在下面解释）：

通过tls.Config，有两种方法可以解决客户端对服务器身份的信任问题：

  1. // 正确的方式
  2. &tls.Config{
  3. RootCAs: caCertPool, // 定义根信任池
  4. }

或者：

  1. // 错误的方式
  2. &tls.Config{
  3. InsecureSkipVerify: true, // 不要在生产环境中使用此选项！
  4. }

应该优先选择前一种方法，后一种方法只用于测试目的。

下面是如何使用客户端证书进行身份验证的示例。

关于双向 TLS 身份验证，有很多博客都有介绍。从客户端的角度来看，基本的步骤如下：

  1. caCert, _ := ioutil.ReadFile("ca.crt")
  2. caCertPool := x509.NewCertPool()
  3. caCertPool.AppendCertsFromPEM(caCert)
  4. cert, _ := tls.LoadX509KeyPair("client.crt", "client.key")
  5. client := &http.Client{
  6. Transport: &http.Transport{
  7. TLSClientConfig: &tls.Config{
  8. RootCAs:      caCertPool,
  9. Certificates: []tls.Certificate{cert},
  10. },
  11. },
  12. }

如果你对服务器有控制权，服务器应该做如下操作：

  1. caCert, _ := ioutil.ReadFile("ca.crt")
  2. caCertPool := x509.NewCertPool()
  3. caCertPool.AppendCertsFromPEM(caCert)
  4. server := &http.Server{
  5. Addr:      ":9443",
  6. TLSConfig: &tls.Config{
  7. ClientCAs:    caCertPool,
  8. ClientAuth:   tls.RequireAndVerifyClientCert,
  9. },
  10. }
英文:

The client-side error you are getting (certificate signed by unknown authority) is related to the client not trusting the server - so has nothing to do with your client cert logic (which I'll address below):

There are two ways to address server identity trust from a client via tls.Config:

  1. // the right way
  2. &amp;tls.Config{
  3. RootCAs: caCertPool, // define a root trust pool
  4. }

or:

  1. // the wrong-way
  2. &amp;tls.Config{
  3. InsecureSkipVerify: true, // DONT USE THIS IN PRODUCTION!
  4. }

the former method should be preferred - the latter should only be used for testing purposes.

See below on how to try this with client certificate authentication.

Mutual TLS authentication is covered in many blogs. From a client perspective, the basic gist is:

  1. caCert, _ := ioutil.ReadFile(&quot;ca.crt&quot;)
  2. caCertPool := x509.NewCertPool()
  3. caCertPool.AppendCertsFromPEM(caCert)
  4. cert, _ := tls.LoadX509KeyPair(&quot;client.crt&quot;, &quot;client.key&quot;)
  5. client := &amp;http.Client{
  6. Transport: &amp;http.Transport{
  7. TLSClientConfig: &amp;tls.Config{
  8. RootCAs: caCertPool,
  9. Certificates: []tls.Certificate{cert},
  10. },
  11. },
  12. }

the server (if you have control over this) should do something like:

  1. caCert, _ := ioutil.ReadFile(&quot;ca.crt&quot;)
  2. caCertPool := x509.NewCertPool()
  3. caCertPool.AppendCertsFromPEM(caCert)
  4. server := &amp;http.Server{
  5. Addr:      &quot;:9443&quot;,
  6. TLSConfig: &amp;tls.Config{
  7. ClientCAs: caCertPool,
  8. ClientAuth: tls.RequireAndVerifyClientCert,
  9. },
  10. }

huangapple
  • 本文由 发表于 2022年9月12日 20:18:19
  • 转载请务必保留本文链接：https://go.coder-hub.com/73689148.html
  • go
  • kubernetes
  • ssl-certificate
  • vault
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定