crypto/x509: certificates at /etc/ssl/certs/ ignored on FreeBSD, etc

[buro1983]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version devel +e6f9f39 Mon Aug 29 18:25:33 2016 +0000 linux/amd64
Checkout 1.7 from git master branch and compiled.

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/ndebnath/opensource"
GORACE=""
GOROOT="/home/ndebnath/golang/go"
GOTOOLDIR="/home/ndebnath/golang/go/pkg/tool/linux_amd64"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build614456670=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"

What did you do?

Install CAcert on FreeBSD system. I placed the certificate in /etc/ssl/certs, calculated the hash
and then created a symlink from /etc/ssl/certs/<ca_file_hash>.0 to cacert.pem.

Now the problem is fetch doesn't even look there. It only looks at
/usr/local/share/certs/ca-root-nss.crt. So if I remove cert.pem then getting below error,

Certificate verification failed for /C=xx/ST=xx/OU=Server/L=unknown/CN=localhost
91426:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:974:
fetch: https://ip:port/v1/agent/checks: Authentication error

And other https request is not going through because of "x509: certificate signed by unknown authority".

During investigation I have seen that go does not checks for /etc/ssl/certs/ location files if symbolic link for nss root exist (https://golang.org/src/crypto/x509/root_unix.go: Line 32). If I comment out this return statement then it worked for me.

What did you expect to see?

Both, systems default ca cert and ca files inside /etc/ssl/certs/ location should work together on FreeBSD.

What did you see instead?

ca file at /etc/ssl/certs/ location is not getting validated when system default ca exist.

[davecheney]

We already check three locations on *BSD systems. Those are believed to be the correct locations, but *BSD's love to change things around. Can you please provide some documentation to demonstrate that this location is stable.

[ikrabbe]

The standard linux way to load certificates is through the /etc/ssl/certs/ca-certificates.crt file, that has a brain-dead update policy, taking several directories and auto-generated configuration files into account. I simply did not manage to add my own certificate on first-shot. Now it is working.

Generally spoken, the load mechanism for root certificates should be more transparent, maybe through

go test -v crypto/x509

.

Not only on FreeBSD but also on my gentoo installation. I can curl the https url and I can google-chrome the url with a nice green lock icon but I cannot

go get https://my.local.service/gitmap?go-get=1

for example. That's what I currently try, actually.

[rsc]

The fact that this is a standard Linux place does not justify looking there on FreeBSD. Can you please point to something indicating that this is a standard FreeBSD location?

[geoffgarside]

@buro1983 is the issue that you want, or expect, /etc/ssl/certs/ directory loaded in addition to /usr/local/share/certs/ca-root-nss.crt from the security/ca_root_nss package?

The loadSystemRoots() will only load one location, once its found and loaded either a CAfile or a CApath it will return and won't scan any further files. This seems right to me, but might not be what you're specifically after.

From the "What did you expect to see?" section it seems like you'd want it to load the first found certFiles entry and then load any certificates found in the certDirectories list?

This kind of feeds in to the comments on https://golang.org/cl/20253 regarding continuing to load certDirectories after loading certFiles.

[gopherbot]

CL https://golang.org/cl/36093 mentions this issue.