'Golang - TLS mutual autentication - How to debug on golang?

I'm trying to make a request to a 3rd party service.

According to the service documentation it uses TLS 1.2 with digital certificates mutual autentication.

I do have the base64 of the certificate.

After some tryes I ended up with this code:

func main() {
    rawDecodedText, err := base64.StdEncoding.DecodeString(certificado)
    if err != nil {
        log.Fatal(err.Error())
    }

    key, cert, err := pkcs12.Decode(rawDecodedText, pwd)

    if err != nil {
        log.Fatal(err.Error())
    }
    caCertPool := x509.NewCertPool()
    caCertPool.AddCert(cert)

    certificate := tls.Certificate{
        Certificate: [][]byte{cert.Raw},
        PrivateKey:  key,
        Leaf:        cert,
    }

    config := &tls.Config{
        Certificates:       []tls.Certificate{certificate},
        RootCAs:            caCertPool,
        CipherSuites:       []uint16{
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
        InsecureSkipVerify: true, // Testing purpose
        MaxVersion:         tls.VersionTLS12,
        MinVersion:         tls.VersionTLS12,
    }
    tr := &http.Transport{

        TLSClientConfig:     config,
        TLSHandshakeTimeout: 60 * time.Second,

    }


    request, err := http.NewRequest("GET", "https://www.gnre.pe.gov.br/gnreWS/services/GnreLoteRecepcao", nil)

    client := &http.Client{
        Transport: tr,
    }
    resp, retErr := client.Do(request)
    if retErr != nil {
        log.Fatal(retErr.Error())
    }
    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        log.Fatal(err.Error())
    }
    fmt.Println("****-***-*-*-*-*-*-*")
    defer resp.Body.Close()
    spew.Dump(resp.TLS)
    fmt.Println("****-***-*-*-*-*-*-*")
    spew.Dump(string(body))
}

But I'm geting a 403. The same one that i get when I try to access the url and I do not select a certificate.

edit: I do know that the error is happening due website and the CA of the certificate.

How can I debug it more ??? Is there a way to get the autentication error in golang ??

I did remove the headers (they are for a POST), it dosen't work nor as a post nor as a get.

Extra info:

I've already tried to acces the page directly via web. It works. I get the 403 whenever i click "cancel" in the certificae tab. If i select a certificate (the same of the base64) I get a succes page.

I Tryed to use postman using the pfx and the password, i got:

Error: write EPROTO 3833908792:error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE:../../third_party/boringssl/src/ssl/tls_record.cc:594:SSL alert number 42

How can I get the error like that in golang?

Edit2:

I found extra data from an external website and It looks like the problem is in the website. I tryed with another certificate (from another CA) and it worked. Despite that the Question keeps valid: is there a way to get the error like the postman one?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source