TLS 和 X. 證書：您的數位護照和安全隧道，Go Crypto 7-Golang-PHP中文網

TLS and X. Certificates: Your Digital Passport and Secure Tunnel, Go Crypto 7

嘿，加密貨幣探索者！準備好深入 TLS 和 X.509 憑證的世界了嗎？將它們視為您的數位護照和網路旅行的安全隧道。讓我們看看 Go 如何幫助我們應對網路安全的這一重要面向！

X.509 證照：您的數位護照

首先，我們來談談 X.509 證書。它們就像數位護照一樣，可以證明網路上實體的身份。讓我們看看如何在 Go 中使用它們：

閱讀您的數位護照

以下是讀取和解析 X.509 憑證的方法：

import (
    "crypto/x509"
    "encoding/pem"
    "fmt"
    "io/ioutil"
)

func main() {
    // Let's read our digital passport
    certPEM, err := ioutil.ReadFile("my_digital_passport.pem")
    if err != nil {
        panic("Oops! We lost our passport!")
    }

    // Decode the PEM block (it's like opening the passport)
    block, _ := pem.Decode(certPEM)
    if block == nil {
        panic("This doesn't look like a passport...")
    }

    // Parse the certificate (reading the passport details)
    cert, err := x509.ParseCertificate(block.Bytes)
    if err != nil {
        panic("We can't read this passport!")
    }

    // Let's see what's in our passport
    fmt.Printf("Passport owner: %s\n", cert.Subject)
    fmt.Printf("Passport issuer: %s\n", cert.Issuer)
    fmt.Printf("Valid from: %s\n", cert.NotBefore)
    fmt.Printf("Valid until: %s\n", cert.NotAfter)
}

登入後複製

創建您自己的數位護照（自簽名證書）

有時，您可能需要建立自己的數位護照進行測試。方法如下：

import (
    "crypto/ecdsa"
    "crypto/elliptic"
    "crypto/rand"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "math/big"
    "os"
    "time"
)

func main() {
    // Let's create our secret key
    privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
    if err != nil {
        panic("Our key generator is feeling shy!")
    }

    // Now, let's fill out our passport application
    template := x509.Certificate{
        SerialNumber: big.NewInt(1),
        Subject: pkix.Name{
            Organization: []string{"Gopher's Cryptographic Adventures"},
        },
        NotBefore: time.Now(),
        NotAfter:  time.Now().Add(time.Hour * 24 * 180), // Valid for 180 days

        KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
        BasicConstraintsValid: true,
    }

    // Time to create our passport!
    derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
    if err != nil {
        panic("The passport printer is jammed!")
    }

    // Let's save our new passport
    certOut, err := os.Create("my_new_passport.pem")
    if err != nil {
        panic("We can't save our new passport!")
    }
    pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
    certOut.Close()

    // And let's keep our secret key safe
    keyOut, err := os.Create("my_secret_key.pem")
    if err != nil {
        panic("We can't save our secret key!")
    }
    pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: x509.MarshalECPrivateKey(privateKey)})
    keyOut.Close()

    fmt.Println("Congratulations! You've got a new digital passport!")
}

登入後複製

TLS：您的安全隧道

現在我們有了數位護照，讓我們用它為我們的網路旅行創建一個安全的隧道。這就是 TLS 發揮作用的地方。

設定安全伺服器（HTTPS 伺服器）

以下是如何設定使用您的數位護照的安全伺服器：

import (
    "crypto/tls"
    "fmt"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "Welcome to our secure tunnel!")
}

func main() {
    http.HandleFunc("/", handler)

    // Let's load our digital passport and secret key
    cert, err := tls.LoadX509KeyPair("my_new_passport.pem", "my_secret_key.pem")
    if err != nil {
        panic("We can't find our passport or secret key!")
    }

    // Now, let's set up our secure tunnel
    tlsConfig := &tls.Config{
        Certificates: []tls.Certificate{cert},
    }

    // Time to open our secure office
    server := &http.Server{
        Addr:      ":443",
        TLSConfig: tlsConfig,
    }

    // Let's start welcoming visitors!
    fmt.Println("Our secure office is open at https://localhost:443")
    err = server.ListenAndServeTLS("", "")
    if err != nil {
        panic("Oops! We couldn't open our office!")
    }
}

登入後複製

建立安全客戶端

現在，讓我們建立一個可以存取我們的安全伺服器的客戶端：

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "net/http"
)

func main() {
    // Let's load the passport of the server we want to visit
    certPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("server_passport.pem")
    if err != nil {
        panic("We can't find the server's passport!")
    }
    if !certPool.AppendCertsFromPEM(pem) {
        panic("This doesn't look like a valid passport...")
    }

    // Now, let's prepare for our secure journey
    tlsConfig := &tls.Config{
        RootCAs: certPool,
    }

    // Time to create our secure transport
    client := &http.Client{
        Transport: &http.Transport{
            TLSClientConfig: tlsConfig,
        },
    }

    // Let's visit the secure server!
    resp, err := client.Get("https://example.com")
    if err != nil {
        panic("Our secure journey failed!")
    }
    defer resp.Body.Close()

    // What did the server say?
    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        panic("We couldn't understand the server's message!")
    }
    fmt.Printf("The server says: %s\n", body)
}

登入後複製