{"action":"created","issue":{"url":"https://api.github.com/repos/google/stenographer/issues/126","labels_url":"https://api.github.com/repos/google/stenographer/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/google/stenographer/issues/126/comments","events_url":"https://api.github.com/repos/google/stenographer/issues/126/events","html_url":"https://github.com/google/stenographer/pull/126","id":125711247,"number":126,"title":"Attempt to add CA cert support","user":{"login":"dcode","id":171574,"avatar_url":"https://avatars.githubusercontent.com/u/171574?v=3","gravatar_id":"","url":"https://api.github.com/users/dcode","html_url":"https://github.com/dcode","followers_url":"https://api.github.com/users/dcode/followers","following_url":"https://api.github.com/users/dcode/following{/other_user}","gists_url":"https://api.github.com/users/dcode/gists{/gist_id}","starred_url":"https://api.github.com/users/dcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcode/subscriptions","organizations_url":"https://api.github.com/users/dcode/orgs","repos_url":"https://api.github.com/users/dcode/repos","events_url":"https://api.github.com/users/dcode/events{/privacy}","received_events_url":"https://api.github.com/users/dcode/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2016-01-08T22:53:39Z","updated_at":"2016-01-14T12:04:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/google/stenographer/pulls/126","html_url":"https://github.com/google/stenographer/pull/126","diff_url":"https://github.com/google/stenographer/pull/126.diff","patch_url":"https://github.com/google/stenographer/pull/126.patch"},"body":"This is me just hacking trying to fix #124. Caveat: I'm new to Go. It compiles, but I'm having issues testing to make sure it fixes the issue. "},"comment":{"url":"https://api.github.com/repos/google/stenographer/issues/comments/171627369","html_url":"https://github.com/google/stenographer/pull/126#issuecomment-171627369","issue_url":"https://api.github.com/repos/google/stenographer/issues/126","id":171627369,"user":{"login":"dcode","id":171574,"avatar_url":"https://avatars.githubusercontent.com/u/171574?v=3","gravatar_id":"","url":"https://api.github.com/users/dcode","html_url":"https://github.com/dcode","followers_url":"https://api.github.com/users/dcode/followers","following_url":"https://api.github.com/users/dcode/following{/other_user}","gists_url":"https://api.github.com/users/dcode/gists{/gist_id}","starred_url":"https://api.github.com/users/dcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcode/subscriptions","organizations_url":"https://api.github.com/users/dcode/orgs","repos_url":"https://api.github.com/users/dcode/repos","events_url":"https://api.github.com/users/dcode/events{/privacy}","received_events_url":"https://api.github.com/users/dcode/received_events","type":"User","site_admin":false},"created_at":"2016-01-14T12:04:55Z","updated_at":"2016-01-14T12:04:55Z","body":"Debugging curl a bit more gives the real error, now that I know I'm looking for NSS.\r\n\r\n~~~\r\n[vagrant@simplerockbuild ~]$ SSLTRACE=3 /usr/bin/curl --verbose     --cert \"$CERTPATH/client_cert.pem\"     --key \"$CERTPATH/client_key.pem\"     --cacert \"$CERTPATH/server_cert.pem\"     \"$@\"     \"https://localhost:1234\"\r\n* About to connect() to localhost port 1234 (#0)\r\n*   Trying 127.0.0.1...\r\n* Connected to localhost (127.0.0.1) port 1234 (#0)\r\n* Initializing NSS with certpath: sql:/etc/pki/nssdb\r\n*   CAfile: /etc/stenographer/certs/server_cert.pem\r\n  CApath: none\r\n* Server certificate:\r\n* \tsubject: CN=127.0.0.1,O=Stenographer\r\n* \tstart date: Jan 11 20:54:32 2016 GMT\r\n* \texpire date: Jan 10 20:54:32 2017 GMT\r\n* \tcommon name: 127.0.0.1\r\n* \tissuer: CN=127.0.0.1,O=Stenographer\r\n* NSS error -8101 (SEC_ERROR_INADEQUATE_CERT_TYPE)\r\n* Certificate type not approved for application.\r\n* Closing connection 0\r\ncurl: (60) Certificate type not approved for application.\r\nMore details here: http://curl.haxx.se/docs/sslcerts.html\r\n~~~\r\n\r\nHere's the root cause: https://bugzilla.mozilla.org/show_bug.cgi?id=1049176\r\n\r\nI'll make the changes you suggested. On startup, I would have expected my code to generate a CA cert, but it didn't. As soon as I get that worked out, I'm completely confident this will work with an OpenSSL backend or NSS backend or anything else that implements the RFC."}}