I have golang app that works as server which a single client accesses by the IP hostname (aaa.bbb.ccc.ddd). Trying to implement mTLS.
Since I have only one client, its cert/key pair (myclient.crt/myclient.key) is directly stored in the server app with the self-signed CA cert (notmyca.crt). The connection between both works, however when I try to curl:
curl "https://aaa.bbb.ccc.ddd:port/endpoint" --key myclient.key --cert myclient.crt --cacert notmyca.crt
I am getting a complain that "certificate subject name 'xxx' does not match target host name 'yyy' "
Steps:
the self-signed ca 'notmyca.crt/notmyca.key' were provided by another application.
Add notmyca.crt certificate to the system:
sudo cp notmyca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
- create a new key for the server app:
openssl genrsa -out my-app.key 2048
- create a csr for the server app:
openssl req -sha256 -new -key tas.key -subj "/CN=differentFromCA" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=IP:aaa.bbb.ccc.ddd")) -out my-app.csr
- create the server cert:
openssl x509 -sha256 -req -in my-app.csr -CA notmyca.crt -CAkey notmyca.key -CAcreateserial -out my-app.crt -days 7300
- verify the cert:
openssl verify my-app.crt
- the verification was ok
- Add my-app.crt certificate to the system:
sudo cp notmyca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
- curl using notmyca.crt
curl "https://aaa.bbb.ccc.ddd:port/endpoint" --key myclient.key --cert myclient.crt --cacert notmyca.crt
- getting the msg: "certificate subject name 'xxx' does not match target host name 'yyy' "
- curl using -k flag:
- if the client cert/key are passed. No problem, getting the expected and right result.
So, what do I have to do for curl to accept the ca cert??