Go语言中自签名TLS证书的正确配置与验证

package main

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "fmt"
    "math/big"
    "os"
    "time"
)

func generateSelfSignedCert(certPath, keyPath string) error {
    // CA 证书模板
    template := x509.Certificate{
        SerialNumber: big.NewInt(1),
        Subject: pkix.Name{
            Organization: []string{"Acme Co"},
            CommonName:   "Self-Signed CA",
        },
        NotBefore: time.Now(),
        NotAfter:  time.Now().Add(365 * 24 * time.Hour), // 有效期一年

        KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
        BasicConstraintsValid: true,
        IsCA:                  true, // 关键：标记为CA证书
    }

    // 生成 RSA 私钥
    privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
    if err != nil {
        return fmt.Errorf("failed to generate private key: %v", err)
    }

    // 使用私钥和模板创建自签名证书
    derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
    if err != nil {
        return fmt.Errorf("failed to create certificate: %v", err)
    }

    // 将证书写入文件 (PEM 格式)
    certOut, err := os.Create(certPath)
    if err != nil {
        return fmt.Errorf("failed to open cert.pem for writing: %v", err)
    }
    defer certOut.Close()
    if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
        return fmt.Errorf("failed to write data to cert.pem: %v", err)
    }
    fmt.Printf("Generated self-signed certificate: %s\n", certPath)

    // 将私钥写入文件 (PEM 格式)
    keyOut, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
    if err != nil {
        return fmt.Errorf("failed to open key.pem for writing: %v", err)
    }
    defer keyOut.Close()
    if err := pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}); err != nil {
        return fmt.Errorf("failed to write data to key.pem: %v", err)
    }
    fmt.Printf("Generated private key: %s\n", keyPath)

    return nil
}

func main() {
    if err := generateSelfSignedCert("cert.pem", "key.pem"); err != nil {
        fmt.Fprintf(os.Stderr, "Error generating certificate: %v\n", err)
        os.Exit(1)
    }
    fmt.Println("Certificate and key generated successfully.")
}

package main

import (
    "crypto/tls"
    "log"
    "net"
)

func handleConnection(conn net.Conn) {
    defer conn.Close()
    log.Printf("Server: Handled connection from %s", conn.RemoteAddr())
    // 这里可以添加具体的业务逻辑
    _, err := conn.Write([]byte("Hello from TLS server!\n"))
    if err != nil {
        log.Printf("Server: Write error: %v", err)
    }
}

func main() {
    cert, err := tls.LoadX509KeyPair("./cert.pem", "./key.pem")
    if err != nil {
        log.Fatalf("Server: LoadX509KeyPair error: %v", err)
    }

    config := &tls.Config{Certificates: []tls.Certificate{cert}}
    listener, err := tls.Listen("tcp", "127.0.0.1:8000", config)
    if err != nil {
        log.Fatalf("Server: Listen error: %v", err)
    }
    defer listener.Close()
    log.Println("Server: Listening on 127.0.0.1:8000")

    for {
        conn, err := listener.Accept()
        if err != nil {
            log.Printf("Server: Accept error: %v", err)
            break
        }
        log.Printf("Server: Accepted connection from %s", conn.RemoteAddr())
        go handleConnection(conn)
    }
}

package main

import (
    "crypto/tls"
    "crypto/x509"
    "io/ioutil"
    "log"
)

func main() {
    // 创建一个新的证书池
    caCertPool := x509.NewCertPool()

    // 读取自签名CA证书
    serverCert, err := ioutil.ReadFile("./cert.pem")
    if err != nil {
        log.Fatalf("Client: Could not load server certificate: %v", err)
    }

    // 将自签名CA证书添加到证书池中
    if ok := caCertPool.AppendCertsFromPEM(serverCert); !ok {
        log.Fatalf("Client: Failed to append server certificate to CA pool")
    }

    // 配置 TLS 客户端
    config := &tls.Config{RootCAs: caCertPool}

    // 建立 TLS 连接
    conn, err := tls.Dial("tcp", "127.0.0.1:8000", config)
    if err != nil {
        log.Fatalf("Client: Dial error: %s", err)
    }
    defer conn.Close()
    log.Printf("Client: Connected to %s", conn.RemoteAddr())

    // 从服务器读取数据
    buf := make([]byte, 1024)
    n, err := conn.Read(buf)
    if err != nil {
        log.Fatalf("Client: Read error: %v", err)
    }
    log.Printf("Client: Received from server: %s", string(buf[:n]))

    // 写入数据到服务器 (可选)
    _, err = conn.Write([]byte("Hello from TLS client!\n"))
    if err != nil {
        log.Fatalf("Client: Write error: %v", err)
    }
}