{"action":"opened","issue":{"url":"https://api.github.com/repos/micro/go-micro/issues/100","repository_url":"https://api.github.com/repos/micro/go-micro","labels_url":"https://api.github.com/repos/micro/go-micro/issues/100/labels{/name}","comments_url":"https://api.github.com/repos/micro/go-micro/issues/100/comments","events_url":"https://api.github.com/repos/micro/go-micro/issues/100/events","html_url":"https://github.com/micro/go-micro/issues/100","id":158593994,"number":100,"title":"How about add CA support for transport","user":{"login":"xujinzheng","id":885569,"avatar_url":"https://avatars.githubusercontent.com/u/885569?v=3","gravatar_id":"","url":"https://api.github.com/users/xujinzheng","html_url":"https://github.com/xujinzheng","followers_url":"https://api.github.com/users/xujinzheng/followers","following_url":"https://api.github.com/users/xujinzheng/following{/other_user}","gists_url":"https://api.github.com/users/xujinzheng/gists{/gist_id}","starred_url":"https://api.github.com/users/xujinzheng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xujinzheng/subscriptions","organizations_url":"https://api.github.com/users/xujinzheng/orgs","repos_url":"https://api.github.com/users/xujinzheng/repos","events_url":"https://api.github.com/users/xujinzheng/events{/privacy}","received_events_url":"https://api.github.com/users/xujinzheng/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-06T03:17:30Z","updated_at":"2016-06-06T03:17:30Z","closed_at":null,"body":"If we use `transport.Secure(true)`, and did not set` tls.config`, then the transport will automatic generate self-signed cert, but the cert is not trusted, we could use  `InsecureSkipVerify` for ignore secure issue while we make a client request, but some tools could not skip it like tool of `ab`, and if we want for support `http2`,  the tools `nghttp`,`h2load` would not support insecure cert too.\r\n\r\nI use these tools to have a load test, it will directly to request to a service node as following:\r\n\r\n```bash\r\n go run main.go\r\n2016/06/06 11:12:06 Listening on [::]:54897\r\n2016/06/06 11:12:06 Broker Listening on [::]:54898\r\n```\r\n\r\n`postdata`\r\n\r\n```\r\n{\"method\":\"Say.Hello\",\"params\":[{\"name\":\"world\"}],\"id\":0}\r\n```\r\n\r\n\r\n```\r\nab -c 100 -n 1000000 -H 'Content-Type: application/json' -p postdata  https://127.0.0.1:54897/`\r\n```\r\n\r\nI generated a private CA Cert, and let system `trusted`, so while we use `transport.Secure(true)`,  set `transport.CACert(certFilepathFromENV, keyFilepathFromENV)`, it will generate cert and issued by this `CA`, so the address of `https://127.0.0.1:54897/` we be trusted, if we do not give CA Cert, then it will generate `self-signed` cert. \r\n\r\n---------------------------\r\n\r\nwhile I to do this work, I coded a tls lab `github.com/gogap/misc/lib/tls`\r\n\r\nit will work as following:\r\n\r\n```go\r\n\r\nimport  gogapTLS \"github.com/gogap/misc/lib/tls\"\r\n\r\nif p.opts.Secure {\r\n\r\n\t\tif tlsConfig == nil {\r\n\t\t\tvar hosts []string\r\n\t\t\tif h, _, e := net.SplitHostPort(addr); e == nil {\r\n\t\t\t\tif h == \"\" {\r\n\t\t\t\t\thosts = getIPAddrList()\r\n\t\t\t\t} else {\r\n\t\t\t\t\thosts = append(hosts, addr)\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tcaConf := getCAConfig(p.opts.Context)\r\n\r\n\t\t\tvar err error\r\n\t\t\tif cert, key, err = gogapTLS.GenerateCertificate(\r\n\t\t\t\tgogapTLS.Host(hosts...),\r\n\t\t\t\tgogapTLS.CAFile(caConf.cert, caConf.key),\r\n\t\t\t); err != nil {\r\n\t\t\t\treturn nil, err\r\n\t\t\t}\r\n\r\n\t\t\tvar cer tls.Certificate\r\n\t\t\tif cer, err = tls.X509KeyPair(cert, key); err != nil {\r\n\t\t\t\treturn nil, err\r\n\t\t\t}\r\n\r\n\t\t\ttlsConfig = &tls.Config{Certificates: []tls.Certificate{cer}}\r\n\t\t}\r\n\r\n\t\tfn := func(addr string) (net.Listener, error) {\r\n\t\t\treturn tls.Listen(\"tcp\", addr, tlsConfig)\r\n\t\t}\r\n\r\n\t\tl, err = listen(addr, fn)\r\n\t} else {\r\n\t\tfn := func(addr string) (net.Listener, error) {\r\n\t\t\treturn net.Listen(\"tcp\", addr)\r\n\t\t}\r\n\r\n\t\tl, err = listen(addr, fn)\r\n\t}\r\n```"}}
{"actor":{"display_login":"xujinzheng"}}