go学习笔记 Windows Go 1.15 以上版本的 GRPC 通信【自签CA和双向认证】

简单说一下我的环境 win7+go1.15.6，GO1.15   X509 不能用了 ，

证书

需要用到SAN证书，下面就介绍一下SAN证书生成。首先需要下载 OpenSSL http://slproweb.com/products/Win32OpenSSL.html 

第1步：生成 CA 根证书

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.pem

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:shanghai
Locality Name (eg, city) []:shanghai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:custer
Organizational Unit Name (eg, section) []:custer
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

第2步：用 openssl 生成 ca 和双方 SAN 证书。

准备默认 OpenSSL 配置文件于当前目录

linux系统在 : /etc/pki/tls/openssl.cnf

Mac系统在: /System/Library/OpenSSL/openssl.cnf

Windows：安装目录下 openssl.cfg 比如 D:\Program Files\OpenSSL-Win64\bin\openssl.cfg

1：拷贝配置文件到项目 然后修改

2：找到 [ CA_default ],打开 copy_extensions = copy

3：找到[ req ],打开 req_extensions = v3_req # The extensions to add to a certificate request

4：找到[ v3_req ],添加 subjectAltName = @alt_names

5：添加新的标签 [ alt_names ] , 和标签字段

[ alt_names ]
DNS.1 = localhost
DNS.2 = *.custer.fun

这里填入需要加入到 Subject Alternative Names 段落中的域名名称，可以写入多个。

第3步：生成服务端证书

 openssl genpkey -algorithm RSA -out server.key

openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=cn/OU=custer/O=custer/CN=localhost" -config ./openssl.cfg -extensions v3_req

openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cfg -extensions v3_req

server.csr是上面生成的证书请求文件。ca.pem/ca.key是CA证书文件和key，用来对server.csr进行签名认证。这两个文件在之前生成的。

第4步：生成客户端证书

openssl genpkey -algorithm RSA -out client.key

openssl req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=cn/OU=custer/O=custer/CN=localhost" -config ./openssl.cfg -extensions v3_req

openssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cfg -extensions v3_req