Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: corporate proxy: certificate signed by unknown authority #40370

Closed
wrschneider opened this issue Jul 23, 2020 · 2 comments
Closed

crypto/x509: corporate proxy: certificate signed by unknown authority #40370

wrschneider opened this issue Jul 23, 2020 · 2 comments
Milestone

Comments

@wrschneider
Copy link

@wrschneider wrschneider commented Jul 23, 2020

go version: go1.14.6 darwin/amd64

go env excerpts:

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/wschnei2/Library/Caches/go-build"
GOENV="/Users/wschnei2/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/wschnei2/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"

Attempted to do go install ./awsproviderlint and failed with x509 error.
Also got same error with http.Get("https://www.google.com")

The problem appears to be how Go handles the certificate chains from my corporate proxy that does re-encryption.

The certificate itself does not include the full chain, only the immediate parent.

Go is picking up the system root certificates, which includes the corporate proxy's root CA cert.

The problem is there is an intermediate cert between the root CA and cert in the chain:

Root->Intermediate 1->Intermediate 2->server cert

The 'intermediate 1' cert is registered in the MacOS System keychain and browsers have no problem with the same sites.

@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 23, 2020

@ianlancetaylor ianlancetaylor changed the title corporate proxy and x509: certificate signed by unknown authority crypto/x509: corporate proxy: certificate signed by unknown authority Jul 23, 2020
@ianlancetaylor ianlancetaylor added this to the Backlog milestone Jul 23, 2020
@FiloSottile
Copy link
Member

@FiloSottile FiloSottile commented Jul 24, 2020

Duplicate of #35631. We're going to try fixing this in Go 1.16, if you need a workaround you can set "intermediate 1" as trusted in the keychain.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
You can’t perform that action at this time.