grpc中TLS认证证书问题

问题
golang 1.15+版本上，用 gRPC通过TLS实现数据传输加密时，会报错证书的问题

panic: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate
is not valid for any names, but wanted to match localhost"

造成的原因是因为我们用的证书，并没有开启SAN扩展（默认是没有开启SAN扩展）所生成的，

导致客户端和服务端无法建立连接

开始解决问题

使用开启扩展SAN的证书
什么是 SAN
　　SAN(Subject Alternative Name) 是 SSL 标准 x509 中定义的一个扩展。使用了 SAN 字段的 SSL 证书，可以扩展此证书支持的域名，使得一个证书可以支持多个不同域名的解析。

生成CA根证书
新建 ca.conf

vim ca.conf

写入内容如下:

[ req ]
default_bits       = 4096
distinguished_name = req_distinguished_name

[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = GuangDong
localityName                = Locality Name (eg, city)
localityName_default        = GuangZhou
organizationName            = Organization Name (eg, company)
organizationName_default    = Sheld
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = Ted CA Test

生成ca秘钥，得到ca.key

openssl genrsa -out ca.key 4096

生成ca证书签发请求，得到ca.csr

openssl req \
-new \
-sha256 \
-out ca.csr \
-key ca.key \
-config ca.conf

　　shell交互时一路回车就行

生成ca根证书，得到ca.crt

openssl x509 \
-req \
-days 3650 \
-in ca.csr \
-signkey ca.key \
-out ca.crt

 

生成终端用户证书
准备配置文件，得到server.conf

vim server.conf

写入内容如下:

 

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext

[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = GuangDong
localityName                = Locality Name (eg, city)
localityName_default        = GuangZhou
organizationName            = Organization Name (eg, company)
organizationName_default    = Sheld
commonName                  = linyouyi
commonName_max              = 64
commonName_default          = linyouyi

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1   = www.linyouyi.com
IP      = 127.0.0.1

　　生成秘钥，得到server.key

openssl genrsa -out server.key 2048

　　生成证书签发请求，得到server.csr

openssl req \
-new \
-sha256 \
-out server.csr \
-key server.key \
-config server.conf

　　shell交互时一路回车就行

用CA证书生成终端用户证书，得到server.crt

openssl x509 \
-req \
-days 3650 \
-CA ca.crt \
-CAkey ca.key \
-CAcreateserial \
-in server.csr \
-out server.pem\
-extensions req_ext \
-extfile server.conf

现在证书已经生成完毕， server.pem 和 server.key就是我们需要的证书和密钥

服务端代码：

creds, err := credentials.NewServerTLSFromFile("./keys/server.pem", "./keys/server.key")

客户端代码：

creds, err := credentials.NewClientTLSFromFile("./keys/server.pem", "linyouyi")

　　报以下错

panic: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate
 is valid for www.linyouyi.com, not linyouyi"

goroutine 1 [running]:
main.main()
        D:/golang/grpc/examples/grpcSSL/client.go:35 +0x7d4
exit status 2

　　改为面的就没问题

creds, err := credentials.NewClientTLSFromFile("./keys/server.pem", "www.linyouyi.com")

 

原文链接：https://blog.csdn.net/m0_37322399/article/details/117308604