VerifyConnection is a function that can be used as the VerifyConnection callback in a tls.Config for a client connection. It performs the same verification that crypto/tls does by default, but it makes use of both the server's intermediates and this package's pool, and it disregards the Time and Ro
(cs tls.ConnectionState)
| 65 | // disregards the Time and RootCAs fields of tls.Config, using their default |
| 66 | // values: the current time and the system roots. |
| 67 | func VerifyConnection(cs tls.ConnectionState) error { |
| 68 | opts := x509.VerifyOptions{ |
| 69 | DNSName: cs.ServerName, |
| 70 | Intermediates: x509.NewCertPool(), |
| 71 | } |
| 72 | for _, cert := range cs.PeerCertificates[1:] { |
| 73 | opts.Intermediates.AddCert(cert) |
| 74 | } |
| 75 | _, err := cs.PeerCertificates[0].Verify(opts) |
| 76 | if err != nil { |
| 77 | // We could simply extend a copy of the pool with the server's |
| 78 | // intermediates and do a single verification, but CertPool.Clone is |
| 79 | // pretty expensive for such a large pool. |
| 80 | _, err = cs.PeerCertificates[0].Verify(x509.VerifyOptions{ |
| 81 | DNSName: cs.ServerName, |
| 82 | Intermediates: pool(), |
| 83 | }) |
| 84 | } |
| 85 | return err |
| 86 | } |