How to Resolve the 'x509: certificate signed by unknown authority' Error When Using Self-Signed TLS Certificates?

Setting Up TLS with a Self-Signed Certificate

In establishing a TLS connection with a self-signed server certificate, users frequently encounter the "x509: certificate signed by unknown authority" error. This issue arises when the client fails to recognize the self-signed certificate as a trusted authority.

To resolve this error, the issue lies in the certificate generation process. The provided code snippet creates a self-signed certificate but neglects to set the "IsCA:true" flag. This flag designates the certificate as a Certificate Authority (CA), enabling it to sign other certificates.

The corrected code should resemble the following:

Generating the Certificate:

func generateCertificate() {
    key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
    if err != nil {
        log.Fatal(err)
    }

    subject := x509.Certificate{
        SerialNumber: big.NewInt(42),
        Subject: pkix.Name{
            Organization: []string{"My Organization"},
        },
    }

    template := x509.Certificate{
        SerialNumber: big.NewInt(43),
        Subject:      subject.Subject,
        KeyUsage: x509.KeyUsageCertSign,
        IsCA:        true, // Setting IsCA to true designates the certificate as a CA
        ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
    }

    cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
    if err != nil {
        log.Fatal(err)
    }

    // Save the certificate and key to pem files
}

Client Configuration:

func clientSetup() (*tls.Config, error) {
    cert, err := ioutil.ReadFile("./cert.pem")
    if err != nil {
        return nil, err
    }

    certpool := x509.NewCertPool()
    certpool.AppendCertsFromPEM(cert)

    config := &tls.Config{
        RootCAs:    certpool,
        InsecureSkipVerify: true, //!!! Skip certificate verification for testing purposes only
    }

    return config, nil
}

Note: For production environments, certificate verification should be enabled to ensure the authenticity of the server.

The above is the detailed content of How to Resolve the 'x509: certificate signed by unknown authority' Error When Using Self-Signed TLS Certificates?. For more information, please follow other related articles on the PHP Chinese website!