Specifying cert+key when making request

[popstr]

Hi,

I am trying to make an HTTPS call (SOAP 😱) to a third-party service that requires a PEM cert and key. It works fine using curl, but I can't seem to figure out how to replicate the request using Resty.

This is the curl command:

curl --cert ./mycert.crt.pem --key ./mycert.key.pem -d @request.xml --header "content-type:text/xml" https://service.com/version/

I believe I need to use the SetTLSClientConfig func, but I am not sure how to correctly create the tls.Config object.

[popstr]

This is what i currently have, but it changes all the time as I am experimenting:

client := resty.New().
		SetTLSClientConfig(&tls.Config{
			Renegotiation: tls.RenegotiateOnceAsClient,
			Certificates: []tls.Certificate{
				{
					Leaf: &x509.Certificate{
						PublicKey: pemCert,
					},
					PrivateKey: pemKey,
				},
			},
		}).
		SetTimeout(10 * time.Second).
		SetBaseURL(baseUrl)

[batara666]

Have you try this:

https://github.com/go-resty/resty#custom-root-certificates-and-client-certificates
https://pkg.go.dev/github.com/go-resty/resty/v2#Client.SetCertificates

[popstr]

Tried it, still getting the same error - alertHandshakeFailure (40)

Variables pemCert and pemKey contains the cert/key data.

myCert, err := tls.X509KeyPair(pemCert, pemKey)
if err != nil {
	panic("ERROR client certificate")
}

client := resty.New().
	SetCertificates(myCert).
	SetTLSClientConfig(&tls.Config{
		Renegotiation: tls.RenegotiateOnceAsClient,
	}).
	SetTimeout(10 * time.Second).
	SetBaseURL(baseUrl)

[popstr]

Now it works!

The issue was that I (accidentally) re-wrote the TLSClientConfig object. I first set the cert (which creates a new tls.Config object), and on the next line I overwrite the TLSClientConfig without the certificate. This is a non-obvious behavior imho. You need to read the upstream code to understand what is actually happening.

This is what works:

myCert, err := tls.X509KeyPair(pemCert, pemKey)
if err != nil {
	panic("ERROR client certificate")
}
client := resty.New().
	SetTLSClientConfig(&tls.Config{
		Renegotiation: tls.RenegotiateOnceAsClient,
		Certificates:  []tls.Certificate{myCert},
	}).
	SetTimeout(10 * time.Second).
	SetBaseURL(baseUrl)

It would also work to reverse the order of SetCertificates and SetTLSClientConfig in my last (non-working) example.

Thanks a bunch @batara666!