crypto/tls: be more specific about errors `bad record MAC`

[OO00O0O]

I've got error tls: bad record MAC
Problem was that service was making request over https://127.0.0.1, rather http://127.0.0.1.
Proposal would be, to provide more specific error message that could be used resolving incidents.
Example: bad record MAC - request without domain

[seankhliao]

cc @FiloSottile

[galdor]

I get these errors each time Curl (and probably other clients) connects to an HTTP server with TLS. The server is using a valid certificate but Curl does not have the right CA certificate, so it fails as expected ("curl: (60) SSL certificate problem: unable to get local issuer certificate"). However Go's net/http server logs:

http: TLS handshake error from <address>: local error: tls: bad record MAC

This message is not logged if Curl uses the right CA. Should the TLS layer log these kinds of message? They seem to be completely unrelated to the server and pollute logs.

[francislavoie]

This comes up with Caddy (albeit less noisily because we throw all stdlib TLS logs to debug level) when using self-signed certs that the client doesn't trust.

It would help to have a more meaningful error message for debugging. Does the client tell the server anything meaningful? Could we bubble up the fact it's a trust issue, instead of it looking like a cryptic protocol data issue?

This is trivially reproduced by making a cert with something like openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365, running a Go server with that (e.g. Caddy with tls cert.pem key.pem, with debug logging on), then connecting with curl -v https://localhost

[rcleveng]

I'm hitting this against cloud run services with 100k HTTP payloads, Is there any way to debug what's going on here?