Golang httpClient CA certificates default location?

Question

I have a go program that connects to an internal API using the httpClient (it's all generated by swagger-codegen).

The internal API is using https and internal certificates with our internal CA.

On my Windows laptop, it works fine without specifying any CA.

On a Linux server, it fails with a x509: certificate signed by unknown authority error.

I believe our Windows corporate laptops have CA installed by default, and that golang is able to get those CA without any config.

Hence i would like to know where is go checking for CAs on both Linux and Windows, so i could compare the setup between both OSes and install the correct CA on Linux.

Linux certs locations are defined here https://golang.org/src/crypto/x509/root_linux.go — Mukesh Sharma, Nov 23 '18 at 09:57
Thanks, i found this in another answer, and the ones for Windows here: https://golang.org/src/crypto/x509/root_windows.go — gotson, Nov 23 '18 at 10:00
Possible duplicate of [Where is Golang picking up root CAs from?](https://stackoverflow.com/questions/40051213/where-is-golang-picking-up-root-cas-from) — Mukesh Sharma, Nov 23 '18 at 10:02
yes, as stated in the answer, but it's only for Linux whereas i was also asking for Windows — gotson, Nov 23 '18 at 10:05

score 7 · Accepted Answer · edited Oct 04 '20 at 07:54

7

For Windows: https://golang.org/src/crypto/x509/root_windows.go

For Linux: https://golang.org/src/crypto/x509/root_linux.go

Found via this SO answer.

edited Oct 04 '20 at 07:54

Carson McManus

314
5
10

answered Nov 23 '18 at 10:01

gotson

3,613
1
23
40

score 2 · Answer 2 · answered Jun 07 '21 at 18:41

To answer the Linux half of your question: Most Linux distributions come with strace, a utility for tracing system calls.

To start monitoring the server's file-related syscalls:

$ sudo strace -fp $MY_SERVER_PID -e trace=file

The server may only try to access the certificates the first time it attempts to initiate a secure connection, so it may be necessary to restart the server and start tracing it before the first connection. Another option is to start the server via strace:

$ sudo strace -f -e trace=file /usr/bin/my-server

If your tracing is successful, you will find something along the lines of

[pid 19691228] openat(AT_FDCWD, "/etc/ssl/certs/ca-certificates.crt", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)

Golang httpClient CA certificates default location?

2 Answers2