tls: no renegotiation error on HTTP request

Question

I'm trying to make a simple HTTP request in Go, after directly following the guides I keep getting the same error:

local error: tls: no renegotiation

I don't quite understand how to interpret this? I know it's not an issue on the server as when I call the same request from python it returns fine. Here's my code:

package main

import (
    "fmt"
    "net/http"
    "net/url"
    "strings"
    "time"
)

func main() {
    timeout := time.Duration(20 * time.Second)
    client := &http.Client{
        Timeout: timeout,
    }
    data := url.Values{
        "top":   {"10"},
        "lDate": {"2019-01-01"},
    }
    req, err := http.NewRequest("POST", "https://api.*********.com/AppAvailLoads?", strings.NewReader(data.Encode()))
    if err != nil {
        fmt.Println("Error in construction")
    }
    req.Header.Add("x-cdata-authtoken", "********")
    req.Header.Add("content-type", "application/x-www-form-urlencoded")
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error in request")
        fmt.Println(err)
    } else {
        fmt.Println(resp.Body)
        resp.Body.Close()
    }
}

score 19 · Answer 1 · edited May 06 '22 at 01:51

19

The solution was to to enable TLS renegotiation (go figure, I know), which is a constant that's part of the tls package as follows:

tr := &http.Transport{
    TLSClientConfig: &tls.Config{
        Renegotiation: tls.RenegotiateOnceAsClient,
        // You may need this if connecting to servers with self-signed certificates
        // InsecureSkipVerify: true,
    },
}

client := &http.Client{
    Timeout:   timeout,
    Transport: tr,
}

Which is weird, as no guides online explain this or show examples of how a common error such as local error: tls: no renegotiation occurs. I hope this is useful for people coming from other languages as it's not something one usually deals with!

edited May 06 '22 at 01:51

ItalyPaleAle

7,185
6
42
69

answered Aug 08 '19 at 23:02

Adrian Coutsoftides

1,203
1
16
38

1

if you wish you can also make your connection actually use tls instead of discarding this level of security when you give "InsecureSkipVerify: true" ... do you own the api server and have access to its public cert ? If so its a couple more lines go jack up the http.Client with a secure tls connection – Scott Stensland Aug 08 '19 at 23:15
I can confirm that the InsecureSkipVerify is not needed to fix the tls renegotiation issue, however if your using a non trusted domain e.g. for your test server then you might have it set. – chim Sep 04 '20 at 09:30
thank you, Renegotiation: tls.RenegotiateOnceAsClient, safed my working hours. – abulbul Dec 19 '20 at 18:50
Thanks for this. Works too `tls.RenegotiateOnceAsClient` – Louie Miranda Apr 20 '22 at 07:33
Thank you for tls.RenegotiateOnceAsClient – Ady Junior Jul 05 '22 at 19:59

tls: no renegotiation error on HTTP request

1 Answers1

Linked