crypto/tls: Client-side certificate doesn't work with tip

[anacrolix]

What version of Go are you using (go version)?

$ go version
go version devel +ae65615 Wed Nov 21 00:10:38 2018 +0000 linux/amd6

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOHOSTARCH="amd64"
GOHOSTOS="linux"

What did you do?

A tls.Config containing a single client-side certificate fails with remote error: unknown certificate on the recent go version. With release (1.11), this doesn't happen. Setting tls max version 1.2 doesn't seem to help. May be related to #28779.

[agnivade]

Hi @anacrolix - Can you provide us with a reproducible code sample ? It would help us a lot to quickly debug this issue.

[anacrolix]

I suspect the author of recent changes to crypto/tls client-side handshakes will be best equipped. I don't have the time at present to isolate any more than I have above.

[agnivade]

/cc @FiloSottile

[FiloSottile]

No need to isolate it further, but I will need more details to debug this. What's the config? What certificate? Is the server public? If the server is a Go server, what config and version?

[anacrolix]

var (
	confluenceTlsConfig = &tls.Config{
		// InsecureSkipVerify: true,
	}
	confluenceHttpTransport = &http.Transport{
		TLSClientConfig: confluenceTlsConfig,
	}
	confluenceHTTPClient = &http.Client{
		Transport: confluenceHttpTransport,
	}
)

func setPrivateConfluenceTlsConfig() {
	confluenceTlsConfig.ServerName = "localhost"
	// confluenceTlsConfig.MaxVersion = tls.VersionTLS12
	confluenceTlsConfig.RootCAs = func() *x509.CertPool {
		ret := x509.NewCertPool()
		b, err := ioutil.ReadFile("private.pem")
		expect.Nil(err)
		expect.Ok(ret.AppendCertsFromPEM(b))
		return ret
	}()
	confluenceTlsConfig.Certificates = func() []tls.Certificate {
		cert, err := tls.LoadX509KeyPair("private.pem", "private.pem")
		expect.Nil(err)
		return []tls.Certificate{cert}
	}()
}

private.pem is a self-signed certificate. The server is public, it's a Haskell warp-tls server. If I build the client side (in Go) with 1.11, it works fine. With go +ae65615 it does not. The failing call is a "golang.org/x/net/websocket".DialConfig with the above TLS config.

[FiloSottile]

Thank you for the extra info! Can you share the address of the server so I can test it?

[anacrolix]

You may run it yourself, it's https://github.com/anacrolix/transcoder. I believe you can just do stack run from the directory (with stack installed, Haskell entails). I'll also email you the private address of an instance. Thanks.

[gopherbot]

Change https://golang.org/cl/151660 mentions this issue: crypto/tls: fix client certificates support for legacy servers

[anacrolix]

This worked, thanks.