To create a self-signed certificate for testing, follow these OpenSSL commands:

# Generate private key
openssl genrsa -des3 -out private.key 2048
openssl rsa -in private.key -out private.key

# Create certificate authority
openssl req -new -x509 -key private.key -out rootCA.pem -days 3650

# Generate certificate signing request
openssl req -new -key private.key -out certificate.csr

# Issue the certificate
openssl x509 -req -days 3650 -in certificate.csr -CA rootCA.pem -CAkey private.key -CAcreateserial -out server.pem -days 3650

HTTP Requests Using HTTPLIB

Example of making a GET request:

endpoint := "https://192.168.1.100:8443/download?resource=abc123"
request := httplib.Get(endpoint)
request.SetTimeout(30*time.Second, time.Duration(timeout)*time.Second)
response, err := request.Response()

Example of making a POST request:

endpoint := "https://192.168.1.100:8443/upload"
request := httplib.Post(endpoint)
request.SetTimeout(30*time.Second, time.Duration(timeout)*time.Second)
request.Body(string(payload))
response, err := request.Response()

Common Certificate Validation Errors

Error: x509: cannot verify certificate for xxx because it contains no IP SANs

This occurs when accessing a server via IP address without proper Subject Alternative Names (SANs) in the certificate.

Solutions:

1. Map the IP to a domain in your hosts file and access via domain name
2. Disable certificate verification (not recommended for production):

   request.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})
   
   

3. Generate certificate with IP SANs:

   echo "subjectAltName = IP:192.168.1.100" > san.cnf
   openssl x509 -req -days 3650 -in certificate.csr -CA rootCA.pem -CAkey private.key -CAcreateserial -extfile san.cnf -out server.pem
   
   

Error: x509: certificate signed by unknown authority

This happens when the client doesn't trust the certificate's signing authority.

Solutions:

1. Disable certificate verification (for testing only):

   request.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})
   
   

2. Add trusted root certificates:

   // Load certificate file
   certData, err := os.ReadFile("rootCA.pem")
   if err != nil {
       log.Fatal("Failed to read CA certificate:", err)
   }
   
   // Create certificate pool
   certPool := x509.NewCertPool()
   if !certPool.AppendCertsFromPEM(certData) {
       log.Fatal("Failed to parse certificate")
   }
   
   // Configure TLS
   request := httplib.Post("https://example.com/api")
   request.SetTLSClientConfig(&tls.Config{
       RootCAs: certPool,
   })
   
   // Execute request
   request.SetTimeout(30*time.Second, time.Duration(timeout)*time.Second)
   request.Body(string(payload))
   response, err := request.Response()
   
   

For multiple root certifiactes, append them to the same pool:

certPool.AppendCertsFromPEM(additionalCertData)