Adding certificate to a rest call

I am making rest api call to fetch some data but I am getting

 Post \"https://url:8200/v1/login\": x509: certificate signed by unknown authority]

then I started sending crt with below modification

<!-- begin snippet: js hide: false console: true babel: false -->

<!-- language: lang-html -->

certPath := "path/certficate.crt"
cert, crtErr := ioutil.ReadFile(certPath)
if crtErr != nil {
//
}
//var crtErr error
tp := http.DefaultTransport.(*http.Transport).Clone()
if tp.TLSClientConfig.RootCAs, crtErr = x509.SystemCertPool(); crtErr != nil {
//error
}
if tp.TLSClientConfig.RootCAs == nil {
tp.TLSClientConfig.RootCAs = x509.NewCertPool()
}
if tp.TLSClientConfig.RootCAs == nil {
// error msg
}	 
caCertPool, crtErr := x509.SystemCertPool()
if crtErr != nil {
//error
}
if tp.TLSClientConfig.RootCAs == nil {
caCertPool = x509.NewCertPool()
}
caCertPool.AppendCertsFromPEM(cert)
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
ClientCAs: caCertPool,
// tried this too	RootCAs: caCertPool},
},
},
}
// Due to security reason  below code is not reommended.
// this works if added.
//	tr := &http.Transport{}
//TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
//}
var jsonByte *bytes.Buffer
jsonByte = bytes.NewBuffer(payloadMap)
req, err := http.NewRequest(httpMethod, url, jsonByte) // URL-encoded payload
if err != nil {
// error
}
req.Header.Add("Content-Type", "application/json")
if headerData != "" {
req.Header.Add("X-Vault-Token", headerData)
}
resp, errr := client.Do(req)

<!-- end snippet -->

This is not helping, I did try generating crt via docker file using below command
due to the interactive command run, it didn't work either

openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -key rootCA.key -days 3650 -out rootCA.crt

Need to resolve this Post &quot;https://url:8200/v1/login&quot;: x509: certificate signed by unknown authority] .

#golang #dockeriamge #vaultrestapi-integration

The client-side error you are getting (certificate signed by unknown authority) is related to the client not trusting the server - so has nothing to do with your client cert logic (which I'll address below):

There are two ways to address server identity trust from a client via tls.Config:

// the right way
&tls.Config{
RootCAs: caCertPool, // define a root trust pool
}

or:

// the wrong-way
&tls.Config{
InsecureSkipVerify: true, // DONT USE THIS IN PRODUCTION!
}

the former method should be preferred - the latter should only be used for testing purposes.

See below on how to try this with client certificate authentication.

Mutual TLS authentication is covered in many blogs. From a client perspective, the basic gist is:

caCert, _ := ioutil.ReadFile("ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
cert, _ := tls.LoadX509KeyPair("client.crt", "client.key")
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
RootCAs: caCertPool,
Certificates: []tls.Certificate{cert},
},
},
}

the server (if you have control over this) should do something like:

caCert, _ := ioutil.ReadFile("ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
server := &http.Server{
Addr:      ":9443",
TLSConfig: &tls.Config{
ClientCAs: caCertPool,
ClientAuth: tls.RequireAndVerifyClientCert,
},
}