'Golang - TLS mutual autentication - How to debug on golang?
I'm trying to make a request to a 3rd party service.
According to the service documentation it uses TLS 1.2 with digital certificates mutual autentication.
I do have the base64 of the certificate.
After some tryes I ended up with this code:
func main() {
rawDecodedText, err := base64.StdEncoding.DecodeString(certificado)
if err != nil {
log.Fatal(err.Error())
}
key, cert, err := pkcs12.Decode(rawDecodedText, pwd)
if err != nil {
log.Fatal(err.Error())
}
caCertPool := x509.NewCertPool()
caCertPool.AddCert(cert)
certificate := tls.Certificate{
Certificate: [][]byte{cert.Raw},
PrivateKey: key,
Leaf: cert,
}
config := &tls.Config{
Certificates: []tls.Certificate{certificate},
RootCAs: caCertPool,
CipherSuites: []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
},
InsecureSkipVerify: true, // Testing purpose
MaxVersion: tls.VersionTLS12,
MinVersion: tls.VersionTLS12,
}
tr := &http.Transport{
TLSClientConfig: config,
TLSHandshakeTimeout: 60 * time.Second,
}
request, err := http.NewRequest("GET", "https://www.gnre.pe.gov.br/gnreWS/services/GnreLoteRecepcao", nil)
client := &http.Client{
Transport: tr,
}
resp, retErr := client.Do(request)
if retErr != nil {
log.Fatal(retErr.Error())
}
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
log.Fatal(err.Error())
}
fmt.Println("****-***-*-*-*-*-*-*")
defer resp.Body.Close()
spew.Dump(resp.TLS)
fmt.Println("****-***-*-*-*-*-*-*")
spew.Dump(string(body))
}
But I'm geting a 403. The same one that i get when I try to access the url and I do not select a certificate.
edit: I do know that the error is happening due website and the CA of the certificate.
How can I debug it more ??? Is there a way to get the autentication error in golang ??
I did remove the headers (they are for a POST), it dosen't work nor as a post nor as a get.
Extra info:
I've already tried to acces the page directly via web. It works. I get the 403 whenever i click "cancel" in the certificae tab. If i select a certificate (the same of the base64) I get a succes page.
I Tryed to use postman using the pfx and the password, i got:
Error: write EPROTO 3833908792:error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE:../../third_party/boringssl/src/ssl/tls_record.cc:594:SSL alert number 42
How can I get the error like that in golang?
Edit2:
I found extra data from an external website and It looks like the problem is in the website. I tryed with another certificate (from another CA) and it worked. Despite that the Question keeps valid: is there a way to get the error like the postman one?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
