[[email protected] ~]# echo "192.168.10.100   zigoo.com" >> /etc/hosts
[[email protected] ~]# more /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.10.100   zigoo.com
[[email protected]

~]#

[[email protected] ~]# tree $GOPATH/src/contoso.org -L 3  ##檢視專案目錄結構

/root/code/go/src/contoso.org
├── client
│   ├── client.go
│   └── debug
└── server
    ├── debug
    └── server.go

2 directories, 4 files

[[email protected] ~]#

[[email protected] ~]# cd $GOPATH/src/contoso.org/client
[[email protected]

client]# openssl genrsa -out ca.key 2048    ## 1). 生成一個CA私鑰
Generating RSA private key, 2048 bit long modulus
.......................................................................................................................................................+++
..........+++
e is 65537 (0x10001)
[[email protected] client]# openssl req -x509 -new -nodes -key ca.key -days 365 -out ca.crt   ## 2).使用ca私鑰生成客戶端的數字證書
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GuangDong
Locality Name (eg, city) [Default City]:ShenZhen
Organization Name (eg, company) [Default Company Ltd]:ZiGoo
Organizational Unit Name (eg, section) []:                    ## 直接按回車鍵跳過
Common Name (eg, your name or your server's hostname) []:zigoo.com
Email Address []:[email protected]
[[email protected] client]#
客戶端：
私鑰檔案   ca.key
數字證書   ca.crt

[[email protected] client]#tree $GOPATH/src/contoso.org -L 3  ##檢視專案目錄結構
/root/code/go/src/contoso.org
├── client
│   ├── ca.crt
│   ├── ca.key
│   ├── client.go
│   └── debug
└── server
    ├── debug
    └── server.go

2 directories, 6 files
[[email protected] client]#

[[email protected] client]#cp ca.key ca.crt $GOPATH/src/contoso.org/server

[[email protected] client]#cd $GOPATH/src/contoso.org/server

[[email protected] server]#openssl genrsa -out server.key 2048   ## 3). 生成一個伺服器端私鑰
Generating RSA private key, 2048 bit long modulus
........+++
......................................+++
e is 65537 (0x10001)
[[email protected] server]# openssl req -new -key server.key -out server.csr   ## 4). 使用伺服器端私鑰生成數字證書請求
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GuangDong
Locality Name (eg, city) [Default City]:ShenZhen
Organization Name (eg, company) [Default Company Ltd]:ZiGoo
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:zigoo.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:

## 5).  使用客戶端CA私鑰簽發伺服器端的數字證書

[[email protected] server]#openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

Signature ok
subject=/C=CN/ST=GuangDong/L=ShenZhen/O=ZiGoo/CN=zigoo.com/[email protected]
Getting CA Private Key

伺服器端：
私鑰檔案   server.key
數字證書   server.crt

[[email protected] server]#tree $GOPATH/src/contoso.org -L 3  ##檢視專案目錄結構
/root/code/go/src/contoso.org
├── client
│   ├── ca.crt
│   ├── ca.key
│   ├── client.go
│   └── debug
└── server
    ├── ca.crt
    ├── ca.key
    ├── ca.srl
    ├── debug
    ├── server.crt
    ├── server.csr
    ├── server.go
    └── server.key

2 directories, 12 files
[[email protected] server]#

使用Go建立一個HTTPS Web Server

/root/code/go/src/contoso.org/server/server.go :

package main

import (
    "fmt"
    "net/http"
)

func handler(res http.ResponseWriter, req *http.Request) {
    fmt.Fprintf(res, "Hi, This is an example of https service in golang!\n")
    fmt.Fprintf(res,
        `[{"Name":"jason","Age":35,"Weight":60.3,"Speciality":"computer science","Hobby":["tennis","swimming","reading"],"Score":725.5,"Secret":"SRRMb3ZlFFlvdSE="}]`)
}

func main() {
    http.HandleFunc("/", handler)
    http.ListenAndServeTLS(":8081", "server.crt", "server.key", nil)
}

[[email protected] ~]# cd $GOPATH/src/contoso.org/server  ##伺服器端路徑
[[email protected] server]# go run server.go    ##臨時性非全域性執行程式，注意，要先啟動伺服器端

在瀏覽器地址欄輸入：https://zigoo.com:8081    
頁面顯示：“Your connection is not secure” 瀏覽器無法訪問HTTPS Web Server

該瀏覽器跳過單向證書校驗的臨時辦法：

Advanced ---> Add Exception...---> Confirm Security Exception
取消在該瀏覽器上新增的安全異常，恢復到這個瀏覽器需要的單向證書校驗狀態：

Preferences ---> Advanced ---> View Certificates ---> Servers ---> Unknown (Not Stored) zigoo.com:8081 ---> Delete...---> OK

a). 在Servers選項卡內滾動列表到下面，發現與zigoo.com內容相關的行刪掉；

b)  在Authorities選項卡內滾動列表到下面，發現與ZiGoo內容相關的行刪掉；

注意：必須重新啟動HTTPS Web Server，按組合鍵 Ctrl + C 退出 go run server.go 啟動的HTTPS Web Server，

這樣重新整理瀏覽器才會再一次地看到“Your connection is not secure”

[[email protected] ~]#cd $GOPATH/src/contoso.org/server  ##伺服器端路徑
[[email protected] server]# go run server.go    ##臨時性非全域性執行程式，注意，要先啟動伺服器端，再一次啟動HTTPS Web Server

使用Go建立一個HTTPS Web Client

/root/code/go/src/contoso.org/client/client.go :

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "net/http"
)

func main() {
    pool := x509.NewCertPool()
    caCertPath := "ca.crt"

    caCrt, err := ioutil.ReadFile(caCertPath)
    if err != nil {
        fmt.Println("ReadFile err:", err)
        return
    }
    pool.AppendCertsFromPEM(caCrt)

    tr := &http.Transport{
        TLSClientConfig: &tls.Config{RootCAs: pool},
    }
    client := &http.Client{Transport: tr}
    resp, err := client.Get("https://zigoo.com:8081")
    if err != nil {
        fmt.Println("Get error:", err)
        return
    }
    defer resp.Body.Close()
    body, err := ioutil.ReadAll(resp.Body)
    fmt.Println(string(body))
}

[[email protected] ~]# cd $GOPATH/src/contoso.org/client  ##客戶端路徑
[[email protected] client]# go run client.go    ##臨時性非全域性執行程式，注意，要先啟動伺服器端
Hi, This is an example of https service in golang!
[{"Name":"jason","Age":35,"Weight":60.3,"Speciality":"computer science","Hobby":["tennis","swimming","reading"],"Score":725.5,"Secret":"SRRMb3ZlFFlvdSE="}]
[[email protected] client]#

客戶端的另外一種實現，伺服器端程式碼保持不變，讓客戶端跳過對證書的校驗：

/root/code/go/src/contoso.org/client/client.go :

package main

import (
    "crypto/tls"
    "fmt"
    "io/ioutil"
    "net/http"
)

func main() {
    tr := &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //InsecureSkipVerify引數值只能在客戶端上設定有效
    }
    client := &http.Client{Transport: tr}
    resp, err := client.Get("https://zigoo.com:8081")

    if err != nil {
        fmt.Println("error:", err)
        return
    }
    defer resp.Body.Close()
    body, err := ioutil.ReadAll(resp.Body)
    fmt.Println(string(body))
}

[[email protected] ~]# cd $GOPATH/src/contoso.org/client  ##客戶端路徑
[[email protected] client]# go run client.go    ##臨時性非全域性執行程式，注意，要先啟動伺服器端
Hi, This is an example of https service in golang!
[{"Name":"jason","Age":35,"Weight":60.3,"Speciality":"computer science","Hobby":["tennis","swimming","reading"],"Score":725.5,"Secret":"SRRMb3ZlFFlvdSE="}]
[[email protected] client]#

我們可以看一下伺服器端沒有報錯，客戶端卻同樣地從伺服器端api介面獲得了我們需要的資料。