Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: corporate proxy: certificate signed by unknown authority #40370

Closed
wrschneider opened this issue Jul 23, 2020 · 2 comments
Closed

crypto/x509: corporate proxy: certificate signed by unknown authority #40370

wrschneider opened this issue Jul 23, 2020 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Backlog

Comments

@wrschneider
Copy link

go version: go1.14.6 darwin/amd64

go env excerpts:

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/wschnei2/Library/Caches/go-build"
GOENV="/Users/wschnei2/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/wschnei2/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"

Attempted to do go install ./awsproviderlint and failed with x509 error.
Also got same error with http.Get("https://www.google.com")

The problem appears to be how Go handles the certificate chains from my corporate proxy that does re-encryption.

The certificate itself does not include the full chain, only the immediate parent.

Go is picking up the system root certificates, which includes the corporate proxy's root CA cert.

The problem is there is an intermediate cert between the root CA and cert in the chain:

Root->Intermediate 1->Intermediate 2->server cert

The 'intermediate 1' cert is registered in the MacOS System keychain and browsers have no problem with the same sites.
@ianlancetaylor
Copy link
Contributor

CC @FiloSottile @katiehockman

@ianlancetaylor ianlancetaylor changed the title corporate proxy and x509: certificate signed by unknown authority crypto/x509: corporate proxy: certificate signed by unknown authority Jul 23, 2020
@ianlancetaylor ianlancetaylor added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 23, 2020
@ianlancetaylor ianlancetaylor added this to the Backlog milestone Jul 23, 2020
@FiloSottile
Copy link
Contributor

Duplicate of #35631. We're going to try fixing this in Go 1.16, if you need a workaround you can set "intermediate 1" as trusted in the keychain.

@andig andig mentioned this issue Aug 8, 2020
Closed
@golang golang locked and limited conversation to collaborators Jul 24, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests
4 participants
@FiloSottile @ianlancetaylor @wrschneider @gopherbot