Go version
go version go1.26.4 darwin/arm64
Output of go env in your module/workspace:
AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN='/Users/dannyt/.local/bin'
GOCACHE='/Users/dannyt/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/dannyt/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/gl/9qw1jzv11r5_vxh0ngrk1hcw0000gn/T/go-build392884552=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/dannyt/Projects/go/pkg/mod'
GONOPROXY='<redacted>'
GONOSUMDB='<redacted>'
GOOS='darwin'
GOPATH='/Users/dannyt/Projects/go'
GOPRIVATE='<redacted>'
GOPROXY='<redacted>'
GOROOT='/opt/homebrew/Cellar/go/1.26.4/libexec'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/dannyt/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/homebrew/Cellar/go/1.26.4/libexec/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.26.4'
GOWORK=''
PKG_CONFIG='pkg-config'
What did you do?
Connect to a HTTP server using HTTP client using TLS client certificate authentication.
What did you see happen?
It started failing with what looked like network related errors:
write: broken pipe
use of closed network connection
However in a just a couple of % of requests, the actual error managed to bubble up; An expired client certificate:
remote error: tls: expired certificate
What did you expect to see?
Client certificate expiry (and TLS 1.3 alerts in general) should be reliably surfaced by crypto/tls and in turn http.Transport. The underling connection being closed with no indication of the cause gives a false indication of a network issue, rather than a transport problem.
I've created a reduced example for both bare TLS and with a HTTP client and server:
tls13_alert_reduced.txt
Go version
go version go1.26.4 darwin/arm64
Output of
go envin your module/workspace:What did you do?
Connect to a HTTP server using HTTP client using TLS client certificate authentication.
What did you see happen?
It started failing with what looked like network related errors:
However in a just a couple of % of requests, the actual error managed to bubble up; An expired client certificate:
What did you expect to see?
Client certificate expiry (and TLS 1.3 alerts in general) should be reliably surfaced by
crypto/tlsand in turnhttp.Transport. The underling connection being closed with no indication of the cause gives a false indication of a network issue, rather than a transport problem.I've created a reduced example for both bare TLS and with a HTTP client and server:
tls13_alert_reduced.txt