I would suggest using the system's certificate verification instead. This ends up moving the two minutes of work into the trustd daemon, which then creates a long-lived cache which every program can use.

Of course, the root issue is that this takes two minutes. I've had no luck getting Apple to talk to me about that.

To confirm, we're not talking about the cross-compiled CGO_ENABLED=0 code path, right?

Yes, we're talking about the codepath with cgo. I'm not sure if the no-cgo codepath would be faster.

I am encountering the 20 second delay only with cgo disabled. The first call to security trust-settings-export is what takes up the time. See upspin/upspin#413.

In fact, it takes 20 seconds for security trust-settings-export to report (visible with GODEBUG=x509roots=1):

crypto/x509: exec ["/usr/bin/security" "trust-settings-export" "/var/folders/2r/2wscqnf957d_75ltvpj_n4zc0035qk/T/x509trustpolicy813089759/user"]: exit status 1, SecTrustSettingsCreateExternalRepresentation: No Trust Settings were found.

I wonder if anyone else has observed this? Seems like a long time to determine that there are no trust settings.

To make it take 20 seconds with cgo enabled, you need to import thousands of trust settings. I've provided a file that you can use with security trust-settings-import. I don't recommend doing this outside a VM, as it's not easy to delete those trust settings.

On go version go1.10 darwin/amd64 with 168 trust policies applied (all but one CA as a test) I'm not seeing this take 20 seconds -- around 1.5s on the non-cgo path. This is on my 2013 macbook pro with Firefox and apps running (not an idle machine). #24084 might be a performance win here.

package main

import (
	"crypto/x509"
	"fmt"
	"time"
)

func main() {
	start := time.Now()
	certs, err := x509.SystemCertPool()
	end := time.Now()
	if err != nil {
		panic(err)
	}
	fmt.Printf("found %d certs in %v\n", len(certs.Subjects()), end.Sub(start))
}

$ security trust-settings-export -d trust.plist
...Trust Settings exported successfully.

$ grep '<integer>' trust.plist  | wc -l
     175

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.589059971s
        1.95 real         1.87 user         2.58 sys

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.60052905s
        1.94 real         1.88 user         2.59 sys

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.599523808s
        1.93 real         1.88 user         2.63 sys

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.586739973s
        1.93 real         1.86 user         2.56 sys

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.570033595s
        1.90 real         1.84 user         2.53 sys

$ CGO_ENABLED=0 time go run main.go 
found 173 certs in 1.5935134s
        1.94 real         1.87 user         2.59 sys

I ran into this issue on 1.10.2 (darwin amd64 downloaded from golang.org) thanks to (unintended?) behavior of Blizzard's Battle.net app which created and added thousands of certificates to the System keychain.

This issue manifested for me in net/http returning a "TLS handshake timeout" error for any https connection. I've removed the certificates and connections are now succeeding.

Change https://golang.org/cl/227037 mentions this issue: crypto/x509: use Security.framework without cgo for roots on macOS

I was too optimistic on closing this, I can still reproduce the extreme slowness with hundreds of roots, and it leads to net/http: TLS handshake timeout errors. Interestingly, when there are thousands of roots, even the security tool takes a long time to list them all, but not a long time to export the whole trust settings.

I suffered a lot on this TLS handshake timeout failure. Is this issue related?

$ go get golang.org/x/oauth2
go: golang.org/x/net@v0.0.0-20190628185345-da137c7871d7: Get https://goproxy.io/golang.org/x/net/@v/v0.0.0-20190628185345-da137c7871d7.mod: net/http: TLS handshake timeout

When I run above program, it took

real	0m14.454s
user	0m13.519s
sys	0m0.360s

Change https://golang.org/cl/353132 mentions this issue: crypto/x509: use platform verifier on darwin