{"action":"created","issue":{"url":"https://api.github.com/repos/go-swagger/go-swagger/issues/409","repository_url":"https://api.github.com/repos/go-swagger/go-swagger","labels_url":"https://api.github.com/repos/go-swagger/go-swagger/issues/409/labels{/name}","comments_url":"https://api.github.com/repos/go-swagger/go-swagger/issues/409/comments","events_url":"https://api.github.com/repos/go-swagger/go-swagger/issues/409/events","html_url":"https://github.com/go-swagger/go-swagger/issues/409","id":140326556,"number":409,"title":"mTLS with custom roots known to work?","user":{"login":"ontucker","id":17346502,"avatar_url":"https://avatars.githubusercontent.com/u/17346502?v=3","gravatar_id":"","url":"https://api.github.com/users/ontucker","html_url":"https://github.com/ontucker","followers_url":"https://api.github.com/users/ontucker/followers","following_url":"https://api.github.com/users/ontucker/following{/other_user}","gists_url":"https://api.github.com/users/ontucker/gists{/gist_id}","starred_url":"https://api.github.com/users/ontucker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ontucker/subscriptions","organizations_url":"https://api.github.com/users/ontucker/orgs","repos_url":"https://api.github.com/users/ontucker/repos","events_url":"https://api.github.com/users/ontucker/events{/privacy}","received_events_url":"https://api.github.com/users/ontucker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-03-12T00:39:33Z","updated_at":"2016-03-28T17:05:51Z","closed_at":null,"body":"Has anybody used go-swagger to do end-to-end mutual TLS connections with client and server certificates issued from a custom CA?  I am having quite some difficulty, although I haven't exhaustively debugged it yet.  Just thought I'd ask here to see if it's known whether or not it will work.\r\n\r\nThe basic approach is to modify server.go to set `httpsServer.TLSConfig.ClientAuth = tls.RequestClientCert` and to override the client Transport's `TLSClientConfig` to have a `RootCAs` certpool which I've added my CA root cert to.  The client is reporting \"x509: certificate signed by unknown authority.\"\r\n\r\nI *am* able to get this to work with a simple no-swagger client using net/http directly to issue an HTTPS request with the same certs, so I don't think it's something wrong with the certs themselves."},"comment":{"url":"https://api.github.com/repos/go-swagger/go-swagger/issues/comments/202488124","html_url":"https://github.com/go-swagger/go-swagger/issues/409#issuecomment-202488124","issue_url":"https://api.github.com/repos/go-swagger/go-swagger/issues/409","id":202488124,"user":{"login":"ontucker","id":17346502,"avatar_url":"https://avatars.githubusercontent.com/u/17346502?v=3","gravatar_id":"","url":"https://api.github.com/users/ontucker","html_url":"https://github.com/ontucker","followers_url":"https://api.github.com/users/ontucker/followers","following_url":"https://api.github.com/users/ontucker/following{/other_user}","gists_url":"https://api.github.com/users/ontucker/gists{/gist_id}","starred_url":"https://api.github.com/users/ontucker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ontucker/subscriptions","organizations_url":"https://api.github.com/users/ontucker/orgs","repos_url":"https://api.github.com/users/ontucker/repos","events_url":"https://api.github.com/users/ontucker/events{/privacy}","received_events_url":"https://api.github.com/users/ontucker/received_events","type":"User","site_admin":false},"created_at":"2016-03-28T17:05:51Z","updated_at":"2016-03-28T17:05:51Z","body":"This has veered off from having anything to do with custom root certs, of course.  It looks like some of the recent changes address the ability to see the TLS context in the request handlers, but I'm not sure 53c4f85 is the one I'd cite.  I have yet to try it out, but I saw a change go by that allowed access to the http.Request in the handlers, which would be perfect, as not only does it enable looking at the connection directly in the handlers, but it also allows one to use something like gorilla/context to pass arbitrary info between middleware and handlers.\r\n"}}