一般来说,我从 GoDaddy 获得了 3 个文件:
- 主证书文件
- 服务器私钥
- 捆绑文件
按照以下方式在我的 Go 服务器中配置所有这些文件:
cert, err := tls.LoadX509KeyPair("myalcoholist.pem","myalcoholist.key")
if err != nil {
log.Fatalf("server: loadkeys: %s", err)
}
pem, err := ioutil.ReadFile("cert/sf_bundle-g2-g1.crt")
if err != nil {
log.Fatalf("Failed to read client certificate authority: %v", err)
}
if !certpool.AppendCertsFromPEM(pem) {
log.Fatalf("Can't parse client certificate authority")
}
tlsConfig := &tls.Config{
ClientCAs: certpool,
Certificates: []tls.Certificate{cert},
}
srv := &http.Server{
Addr: "myalcoholist.com:443",
Handler: n,
ReadTimeout: time.Duration(5) * time.Second,
WriteTimeout: time.Duration(5) * time.Second,
TLSConfig: tlsConfig,
}
err := srv.ListenAndServeTLS("cert/myalcoholist.pem","cert/myalcoholist.key")
Web 服务器运行正常,目前发布在 https://myalcoholist.com:443
。
我使用 https://www.ssllabs.com/ssltest/analyze.html?d=myalcoholist.com
验证了我的 SSL,它的响应是 This server's certificate chain is incomplete。等级上限为 B。
您可以转到此链接查看所有详细结果。
我错过了什么?
最佳答案
跟随 that thread ,并来自 net/http/#ListenAndServeTLS()
文档:
If the certificate is signed by a certificate authority, the certFile should be the concatenation of the server's certificate, any intermediates, and the CA's certificate.
尝试并确保您的 cert/myalcoholist.pem
也包含 CA 证书。
使用的线程:
myTLSConfig := &tls.Config{
CipherSuites: []uint16{
tls.TLS_RSA_WITH_RC4_128_SHA,
tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},}
myTLSConfig.PreferServerCipherSuites = true
const myWebServerListenAddress = "0.0.0.0:5555"
myTLSWebServer := &http.Server{Addr: myWebServerListenAddress, TLSConfig: myTLSConfig, Handler: router}
if err = myTLSWebServer.ListenAndServeTLS("/home/loongson/webServerKeysV2/golangCertFile2", "/home/loongson/webServerKeysV2/adequatech.ca-comodoinstantssl-exported-privatekey-rsa-ForApache.key"); err != nil {
panic(err)
}
与 my previous answer 相比,添加密码套件是个好主意,但再次尝试查看传递给 ListenAndServeTLS
的证书文件是否包含 CA 时效果更好。
果然,https://www.ssllabs.com/ssltest/analyze.html?d=myalcoholist.com 报告了 A 级,并带有警告:“链问题:包含 anchor ”。
请参阅“SSL/TLS: How to fix “Chain issues: Contains anchor” ”以删除该警告,但 this is not an error though :
RFC 2119: the server is allowed to include the root certificate (aka "trust anchor") in the chain, or omit it. Some servers include it
关于ssl - 带有 GoDaddy 证书的 HTTP SSL - 此服务器的证书链不完整,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/38170775/