On Darwin systems there's a non-cgo path using the provided security cli tool for gathering certificates to use. (e.g. x509.SystemCertPool()) The current code calls security verify-cert which searches keychains on the filesystem for policies related to the certificate in an attempt to respect trust settings applied.
One can apply a trust setting that would disable "ssl", but Go currently doesn't parse that out of the keychain.
sudo /usr/bin/security add-trusted-cert -d -r deny -p ssl -k /Library/Keychains/System.keychain cert.pem
The problem is that security verify-cert doesn't return kSecTrustSettingsResultDeny if the certificate is only denied for ssl. The flag -p is defaulted to basic (instead of say ssl or codeSign).
This can be verified with the following patch in src/crypto/x509/root_darwin.go.
- cmd := exec.Command("/usr/bin/security", "verify-cert", "-c", f.Name(), "-l", "-L")
+ cmd := exec.Command("/usr/bin/security", "verify-cert", "-p", "ssl", "-c", f.Name(), "-L")
This doesn't solve the problem outside of TLS though. There are multiple policies which can be applied to selectively disable certificates for. The trust policies are better stated in the output of security trust-settings-export, which is already called, but the response not fully parsed.
On Darwin systems there's a non-cgo path using the provided
securitycli tool for gathering certificates to use. (e.g.x509.SystemCertPool()) The current code callssecurity verify-certwhich searches keychains on the filesystem for policies related to the certificate in an attempt to respect trust settings applied.One can apply a trust setting that would disable "ssl", but Go currently doesn't parse that out of the keychain.
The problem is that
security verify-certdoesn't returnkSecTrustSettingsResultDenyif the certificate is only denied for ssl. The flag-pis defaulted tobasic(instead of saysslorcodeSign).This can be verified with the following patch in
src/crypto/x509/root_darwin.go.This doesn't solve the problem outside of TLS though. There are multiple policies which can be applied to selectively disable certificates for. The trust policies are better stated in the output of
security trust-settings-export, which is already called, but the response not fully parsed.