[GODRIVER-643] Verify server certificates using CAs in system certificate stores Created: 19/Nov/18 Updated: 27/Oct/23 Resolved: 15/May/19 |
|
| Status: | Closed |
| Project: | Go Driver |
| Component/s: | Connections |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | New Feature | Priority: | Major - P3 |
| Reporter: | David Golden | Assignee: | David Golden |
| Resolution: | Gone away | Votes: | 0 |
| Labels: | devexp-product | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||
| Description |
|
Revised: Go 1.12 (and 1.11.6) claim to have fixed the Mac issue, so when that toolchain is available we can test against it. For Windows, it doesn't look like Go has fixed it upstream, so we need to find an alternate way of getting the system CAs. That could be something like the go-openssl wrapper system_certs.c code, or, perhaps preferably, something using Go's syscall library or sys/x/windows. Original
|
| Comments |
| Comment by David Golden [ 15/May/19 ] |
|
Testing with custom macos hosts with CA installed in the System keychain passed tools tests. Closing this ticket as "gone away". |
| Comment by David Golden [ 02/May/19 ] |
|
I believe this issue can be resolved if BUILD-8386 gets the tools passing their tests. tl;dr: Go 1.12 provides support, but CA certificates needed to be installed differently on Evergreen to be recognized. Windows:
Mac:
|
| Comment by David Golden [ 19/Nov/18 ] |
|
SetDialer is a possibility. We'd prefer to avoid it as it means we need to keep shipping the openssl DLL with Windows builds. Part of the goal in switching to the Go driver is to stop needing openssl and to stop having to maintain connection logic outside the driver. |
| Comment by Jeffrey Yemin [ 19/Nov/18 ] |
|
An application can already configure a Connection to use the openssl wrapper via func (c *ClientOptions) SetDialer(d ContextDialer) *ClientOptions. This is essentially what mongosqld is doing, for example. Is there a reason that's not a workable solution? |