What version of Go are you using (go version)?
$ go version
1.17.1
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/shivanshvij/Library/Caches/go-build"
GOENV="/Users/shivanshvij/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/shivanshvij/go/pkg/mod"
GONOPROXY="github.com/loophole-labs"
GONOSUMDB="github.com/loophole-labs"
GOOS="darwin"
GOPATH="/Users/shivanshvij/go"
GOPRIVATE="github.com/loophole-labs"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/shivanshvij/go/go1.17.1"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/shivanshvij/go/go1.17.1/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.17.1"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/4h/yyr7_ggd2td0dsymd6750q740000gn/T/go-build2007742489=/tmp/go-build -gno-record-gcc-switches -fno-common"
What did you do?
Creating tls.Conn connections using short-lived certificates with Client Authentication.
Client Config:
t.tlsConfig = &tls.Config{
Certificates: []tls.Certificate{{
Certificate: [][]byte{mtls.Raw},
PrivateKey: privateKey,
}},
RootCAs: caCerts,
}Server Config:
tlsConfig := &tls.Config{
Certificates: []tls.Certificate{{
Certificate: [][]byte{cert.Raw},
PrivateKey: privateKey,
}},
RootCAs: caCerts,
ClientCAs: caCerts,
ClientAuth: tls.RequireAndVerifyClientCert,
}What did you expect to see?
No errors thrown once the certificate expires, and the existing connections allowed to continue functioning.
What did you see instead?
For a few minutes, everything works fine and it's possible to read and write data exactly as expected. Then, as soon as the short-lived x509 certificate expires, the client TLS.Conn connections throw a remote error: tls: bad certificate error.
If that's expected behaviour, is it possible to replace the certificates in the connection somehow? For our use case, we would rather not have to re-create the connections if possible.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env)?go envOutputWhat did you do?
Creating
tls.Connconnections using short-lived certificates with Client Authentication.Client Config:
Server Config:
What did you expect to see?
No errors thrown once the certificate expires, and the existing connections allowed to continue functioning.
What did you see instead?
For a few minutes, everything works fine and it's possible to read and write data exactly as expected. Then, as soon as the short-lived x509 certificate expires, the client TLS.Conn connections throw a
remote error: tls: bad certificateerror.If that's expected behaviour, is it possible to replace the certificates in the connection somehow? For our use case, we would rather not have to re-create the connections if possible.