How to connect to a server using a certificate through Goland?

Question

Digital certificates

I need to write a client in Go that connects to the server via ssl + basic auth and receives a response. I have the certificate itself with the .crt extension, as well as files with the csr, key, p12, keystore extensions. These files were sent by the company I want to connect to. I do the following:

// the CertPool wants to add a root as a []byte so we read the file ourselves
  caCert, err := ioutil.ReadFile("client-file.crt")
  pool := x509.NewCertPool()
  pool.AppendCertsFromPEM(caCert)
  // LoadX509KeyPair reads files, so we give it the paths
  clientCert, err := tls.LoadX509KeyPair("client-file.crt", "file.key")
  tlsConfig := tls.Config{
    InsecureSkipVerify: false,
    RootCAs:            pool,
    Certificates:       []tls.Certificate{clientCert},
  }
  transport := http.Transport{
    TLSClientConfig: &tlsConfig,
  }
  client := http.Client{
    Transport: &transport,
  }

  req, err := http.NewRequest(
    "POST", "url", bytes.NewBuffer(xmlbytes),
  )
  req.SetBasicAuth("login", "pass")
  req.Header.Set("Content-Type", "application/xml")
  resp, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
  }
  respbyte, err := ioutil.ReadAll(resp.Body)
  if err != nil {
    fmt.Println(err)
  }


  buyresp := str.BuyResponse{}
  xml.Unmarshal(respbyte, &buyresp)
  fmt.Println(buyresp.AuthCode, buyresp.ClientTransactionID, buyresp.ErrorCode)

I get an error from the server with code 79999, this error is unknown in the API documentation. What am I doing wrong? I am also getting an error x509: certificate signed by unknown authority. It is not clear why csr, p12, keystore files are needed. On the Internet, on implementation examples, I did not find their preference. url, pass, login in the example are hidden under common names. In their place, of course, normal values

Answer 1

x509: certificate signed by unknown authority.

This is the problem. The publisher's certificate is unknown to your system. There are two ways out:
- either disable the publisher check (accept all certificates, this may not be, but it may be InsecureSkipVerify)
- or make the publisher's certificate (it must be in a .p12 file, although it can be requested separately) trusted. In Windows, this is placing the certificate in the "Trusted Root Centers" store, in Linux - in the openssl installation directory, usually /etc/ssl/certs