grpc通過自簽CA證書、server、client雙向認證【支持go1.15】

fix go1.15bug

openssl 生成證書上 grpc 報 legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
最近用傳統的方式 生成的證書上用golang 1.15. 版本 grpc 通信報上面錯誤

參考：

https://www.cnblogs.com/jackluo/p/13841286.html
https://blog.csdn.net/ma_jiang/article/details/111992609

https://segmentfault.com/a/1190000016601810
https://www.cnblogs.com/devhg/p/13751770.html

創建雙方SAN證書

go version go1.15.3 darwin/amd64
上面調用的時候報錯了

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"

如果出現上述報錯，是因為 go 1.15 版本開始廢棄 CommonName，因此推薦使用 SAN 證書。 如果想兼容之前的方式，需要設置環境變量 GODEBUG 為 x509ignoreCN=0。

什么是 SAN

SAN(Subject Alternative Name) 是 SSL 標准 x509 中定義的一個擴展。使用了 SAN 字段的 SSL 證書，可以擴展此證書支持的域名，使得一個證書可以支持多個不同域名的解析。

下面簡單示例如何用 openssl 生成 ca 和雙方 SAN 證書。

創建CA證書

根證書 根證書（root certificate）是屬於根證書頒發機構（CA）的公鑰證書。我們可以通過驗證 CA 的簽名從而信任 CA ，任何人都可以得到 CA 的證書（含公鑰），用以驗證它所簽發的證書（客戶端、服務端）

它包含的文件如下：

➜  conf git:(master) ✗ openssl                                                                                                  
OpenSSL> genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
...........................................................................................................+++
........+++
e is 65537 (0x10001)
OpenSSL> req -new -x509 -days 7200 -key ca.key -out ca.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:  
State or Province Name (full name) []:
Locality Name (eg, city) []:
Organization Name (eg, company) []:ihuidev 
Organizational Unit Name (eg, section) []:ihuidev
Common Name (eg, fully qualified host name) []:localhost
Email Address []:
OpenSSL> 

修改配置

准備默認 OpenSSL 配置文件於當前目錄

• linux系統 : /etc/pki/tls/openssl.cnf
• Mac系統: /System/Library/OpenSSL/openssl.cnf
• Windows：安裝目錄下 openssl.cfg 比如 D:\Program Files\OpenSSL-Win64\bin\openssl.cfg

1. 拷貝配置文件到項目 然后修改
   cp /System/Library/OpenSSL/openssl.cnf ./

2. 找到 [ CA_default ]，打開 copy_extensions = copy

3. 找到[ req ]，打開 req_extensions = v3_req

4. 找到[ v3_req ]，添加 subjectAltName = @alt_names

5. 添加新的標簽 [ alt_names ] , 和標簽字段

[ alt_names ]
DNS.1 = localhost
DNS.2 = *.custer.fun

接着使用這個臨時配置生成證書：

生成Server

$ openssl genpkey -algorithm RSA -out server.key
 
$ openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=cn/OU=devhg/O=devhg/CN=localhost" -config ./openssl.cnf -extensions v3_req
 
$ openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req

輸出

OpenSSL> genpkey -algorithm RSA -out server.key
..........................................................................+++
..............................................................................+++
OpenSSL> req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=cn/OU=devhg/O=devhg/CN=localhost" -config ./openssl.cnf -extensions v3_req
OpenSSL> x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
Signature ok
subject=/C=cn/OU=devhg/O=devhg/CN=localhost
Getting CA Private Key

生成client

$ openssl genpkey -algorithm RSA -out client.key
 
$ openssl req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=cn/OU=devhg/O=devhg/CN=localhost" -config ./openssl.cnf -extensions v3_req
 
$ openssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req

輸出

OpenSSL> genpkey -algorithm RSA -out client.key
..................+++
...........................................................................................+++
OpenSSL> req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=cn/OU=devhg/O=devhg/CN=localhost" -config ./openssl.cnf -extensions v3_req
OpenSSL> x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
Signature ok
subject=/C=cn/OU=devhg/O=devhg/CN=localhost
Getting CA Private Key
OpenSSL> 

整理目錄

➜  conf git:(master) ✗ tree                  
.
├── ca.key
├── ca.pem
├── ca.srl
├── client
│   ├── client.csr
│   ├── client.key
│   └── client.pem
├── readme.md
└── server
    ├── server.csr
    ├── server.key
    └── server.pem

完整代碼 https://github.com/devhg/grpc-demo