Adding certificate to a rest call

Question

I am making rest api call to fetch some data but I am getting

 Post \"https://url:8200/v1/login\": x509: certificate signed by unknown authority]

then I started sending crt with below modification

certPath := "path/certficate.crt"
cert, crtErr := ioutil.ReadFile(certPath)
if crtErr != nil {
    //
}
//var crtErr error
tp := http.DefaultTransport.(*http.Transport).Clone()
if tp.TLSClientConfig.RootCAs, crtErr = x509.SystemCertPool(); crtErr != nil {
    //error
}
if tp.TLSClientConfig.RootCAs == nil {
    tp.TLSClientConfig.RootCAs = x509.NewCertPool()
}
if tp.TLSClientConfig.RootCAs == nil {
    // error msg
}    
caCertPool, crtErr := x509.SystemCertPool()
if crtErr != nil {
    //error
}
if tp.TLSClientConfig.RootCAs == nil {
    caCertPool = x509.NewCertPool()
}
caCertPool.AppendCertsFromPEM(cert)
client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            ClientCAs: caCertPool,
            // tried this too   RootCAs: caCertPool},
        },
    },
}
// Due to security reason  below code is not reommended.
// this works if added.
//  tr := &http.Transport{}
//TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
//}

var jsonByte *bytes.Buffer
 
    jsonByte = bytes.NewBuffer(payloadMap)
    req, err := http.NewRequest(httpMethod, url, jsonByte) // URL-encoded payload
 
if err != nil {
    // error
}
req.Header.Add("Content-Type", "application/json")
if headerData != "" {
    req.Header.Add("X-Vault-Token", headerData)
}
resp, errr := client.Do(req)

This is not helping, I did try generating crt via docker file using below command due to the interactive command run, it didn't work either

openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -key rootCA.key -days 3650 -out rootCA.crt

Need to resolve this Post "https://url:8200/v1/login": x509: certificate signed by unknown authority] .

#golang #dockeriamge #vaultrestapi-integration

colm.anseo · Answer

The client-side error you are getting (certificate signed by unknown authority) is related to the client not trusting the server - so has nothing to do with your client cert logic (which I'll address below):

There are two ways to address server identity trust from a client via tls.Config:

// the right way
&tls.Config{
    RootCAs: caCertPool, // define a root trust pool
}

or:

// the wrong-way
&tls.Config{
    InsecureSkipVerify: true, // DONT USE THIS IN PRODUCTION!
}

the former method should be preferred - the latter should only be used for testing purposes.

See below on how to try this with client certificate authentication.

Mutual TLS authentication is covered in many blogs. From a client perspective, the basic gist is:

caCert, _ := ioutil.ReadFile("ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)

cert, _ := tls.LoadX509KeyPair("client.crt", "client.key")

client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            RootCAs: caCertPool,
            Certificates: []tls.Certificate{cert},
        },
    },
}

the server (if you have control over this) should do something like:

caCert, _ := ioutil.ReadFile("ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)

server := &http.Server{
    Addr:      ":9443",
    TLSConfig: &tls.Config{
        ClientCAs: caCertPool,
        ClientAuth: tls.RequireAndVerifyClientCert,
    },
}

Adding certificate to a rest call

1 Answers