Golang x509: Certificate is valid for *.<DNS> not <DB_hostname>

I am trying to connect to MySQL DB using SSL via Golang and I am getting this error message
>x509: certificate is valid for *.<address1>, not <DB_hostname>

I have created certificates using this tutorial
https://www.devdungeon.com/content/creating-self-signed-ssl-certificates-openssl

Function to create TLSConf:

func createTLSConf() tls.Config {

    rootCertPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("certificate.pem")
    if err != nil {
        log.Fatal(err)
    }
    if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
        log.Fatal("Failed to append PEM.")
    }
    clientCert := make([]tls.Certificate, 0, 1)

    certs, err := tls.LoadX509KeyPair("certificate.pem", "privkey.pem")
    if err != nil {
        log.Fatal(err)
    }

    clientCert = append(clientCert, certs)

    return tls.Config{
        RootCAs:            rootCertPool,
        Certificates:       clientCert,
        InsecureSkipVerify: false,
    }
}

Connection to DB

	tlsConf := createTLSConf()  
    err := mysql.RegisterTLSConfig("custom", &tlsConf)

    if err != nil {
        log.Printf("Error %s when RegisterTLSConfig\n", err)
        return
    }

    dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?tls=custom", "user", "pass", "db_host", "db_name")
    db, err := sql.Open("mysql", dsn)

    if err != nil {
        log.Printf("Error %s when opening DB\n", err)
        log.Printf("%s", dsn)
        return
    }

Using connection

	defer db.Close()

    e := db.Ping()
    fmt.Println(dsn, e)

    db.Close()

Output:

<user>:<pass>@tcp(<db_host>)/<db_name>?tls=custom x509: certificate is valid for *.abc-xy-pxc, not <db_host>

abc-xy is a part of db_host and also abc_xy is the db_name, nut sure if it is important

When changing InsecureSkipVerify to true, the output looks like this:

[mysql] 2022/10/21 22:31:27 packets.go:37: remote error: tls: unknown certificate authority

Any idea how can I get this to work?

EDIT:

Sooo, I don't know why, but removing part of the code with Client certificates and changing InsecureSkipVerify to true solved the issue:

func createTLSConf() tls.Config {

    rootCertPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("certificate.pem")
    if err != nil {
        log.Fatal(err)
    }
    if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
        log.Fatal("Failed to append PEM.")
    }

    return tls.Config{
        RootCAs:            rootCertPool,
        InsecureSkipVerify: true, // needed for self signed certs
    }
}

Hey I am also new to Go but you can give this a try. Consider my answer might not be the best but I am trying to be more active by helping and asking. You can generate your certificates in terminal and then use them.

run this in terminal at your project directory. (where your main.go located) and the /usr/local/go/src/crypto/tls/generate_cert.go should be the directory where Go standard library is installed.

go run /usr/local/go/src/crypto/tls/generate_cert.go --rsa-bits=2048 --host=localhost

open a DB connection return errors if any:

func openDB(dsn string) (*sql.DB, error){
   db, err := sql.Open("mysql",dsn)
   if err!= nil{
      return nil,err
   }
   if err = db.Ping();err!=nil{
      return nil,err
   }
   return db,nil
}

Then you have to configure your server settings. You will have a http.Server with your pem files.

declare a variable of crypto/tls.Config where only elliptic curves with assembly implementation are used.

tlsConfig := &tls.Config{
   CurvePreferences:[]tls.CurveID{tls.X25519,tls.CurveP256}
}

then declare your server.

yourServer := &http.Server{
   //Your configs
   TLSConfig : tlsConfig,
   //Your other configs if any
}

Now we have created our server with specific TLS configuration. All you have to do is running your server now. However, you have to update your server's method with ListenAndServeTLS(first arg = cert,second arg = key)

err = srv.ListenAndServeTLS(<Location of your cert.pem>, <Location of your key.pem>)