What version of Go are you using (go version)?
$ go version
go version go1.20.5 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/yorick/.cache/go-build"
GOENV="/home/yorick/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/yorick/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/yorick/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.5"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/yorick/Development/dss/udptogrpc/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1398362822=/tmp/go-build -gno-record-gcc-switches"
What did you do?
When running go mod tidy with an import from a local GitLab instance with a non-expired certificate it is reported as expired.
package main
import (
"localgitlabinstance/package"
)
func main() {
package.Function()
}The snippet above illustrates the basic setup used. When running go mod tidy it returns the following output:
go mod tidy Output
server response: not found: localgitlabinstance/package@v0.0.0-20230606093113-3ea3ca83ba60: unrecognized import path "localgitlabinstance/package": https fetch: Get "localgitlabinstance/package?go-get=1": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2023-06-07T08:48:08Z is after 2013-07-26T11:03:57Z
When checking the certificate via Chrome and by using echo | openssl s_client -showcerts -servername localgitlabinstance -connect localgitlabinstance:443 2>/dev/null | openssl x509 -inform pem -noout -text the certificate is valid from:
Validity
Not Before: Jan 16 00:00:00 2023 GMT
Not After : Jan 18 23:59:59 2024 GMT
When changing my system time to before 2013-07-26T11:03:57Z I get the following output:
go mod tidy Output
localgitlabinstance/package: cannot find module providing package localgitlabinstance/package: unrecognized import path "localgitlabinstance/package": https fetch: Get "localgitlabinstance/package?go-get=1": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2013-06-01T00:01:16+02:00 is before 2023-01-16T00:00:00Z
It then successfully retrieves the Not Before timestamp.
The path taken from retrieving the certificate retrieval in the TLS handshake to verifying it seems pretty clear, so I'm uncertain where this discrepancy between the crypto/x509 parsing and the other tooling comes from.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env)?go envOutputWhat did you do?
When running
go mod tidywith an import from a local GitLab instance with a non-expired certificate it is reported as expired.The snippet above illustrates the basic setup used. When running
go mod tidyit returns the following output:go mod tidyOutputWhen checking the certificate via Chrome and by using
echo | openssl s_client -showcerts -servername localgitlabinstance -connect localgitlabinstance:443 2>/dev/null | openssl x509 -inform pem -noout -textthe certificate is valid from:When changing my system time to before
2013-07-26T11:03:57ZI get the following output:go mod tidyOutputIt then successfully retrieves the
Not Beforetimestamp.The path taken from retrieving the certificate retrieval in the TLS handshake to verifying it seems pretty clear, so I'm uncertain where this discrepancy between the
crypto/x509parsing and the other tooling comes from.