crypto/x509: root_darwin.go does not include trusted root certificates from System/Login keychains #14514

mwielgoszewski · 2016-02-25T23:39:20Z

Tested on go version go1.6 darwin/amd64 and go version go1.5.3 darwin/amd64.
OS X Yosemite, OS X El Capitan
I attempted to connect to a TLS service with a certificate signed by an internal, enterprise certificate authority. The CA certificate was added to the System keychain.
I expected to be able to connect to the TLS service without any issue as the certificate is signed by a CA I trust.
The program failed to connect to the TLS service, because the CA certificate that issued the certificate is not installed in the SystemRootCertificates.keychain that Go loads trusted roots from.

On OS X Yosemite, this issue can be mitigated by installing the certificate into SystemRootCertificates.keychain via /usr/bin/security from the terminal:

sudo security add-trusted-cert -k /System/Library/Keychains/SystemRootCertificates.keychain <certificate>

However, on El Capitan this is no longer possible without turning off security protections enabled by Apple.

execSecurityRoots should try to load additional certificates from the System keychain located at /Library/Keychains/System.keychain, and the Login keychain (~/Library/Keychains/login.keychain).

This bug makes distributing Go clients (especially 3rd-party developed) difficult in organizations with an internal PKI.

The text was updated successfully, but these errors were encountered:

dndx · 2016-02-26T05:44:38Z

Currently Golang uses security find-certificate command to get a dump of everything that is inside /System/Library/Keychains/SystemRootCertificates.keychain which contains all system-wide root certificates.

Obviously we may simply run security find-certificate multiple times and grab certificates from all three (System Roots, System and login) chains but the last chain login does not actually require root privilege to modify and only applies to the user that is currently logged in.

Look at what we are doing with Linux and BSD, in those OSes we have been importing certificates from only trusted locations (means you need root privilege to change them) we might want to include only /Library/Keychains/System.keychain but not ~/Library/Keychains/login.keychain since the previous one needs root privilege to change and is not affected by SIP.

Just my thought.

mwielgoszewski · 2016-02-26T14:58:54Z

That sounds pretty reasonable, though other suggestions (i.e., #14022, #3905) indicate the Golang project is considering following OpenSSL's conventions by looking up SSL_CA_CERT_FILE or SSL_CA_CERT_PATH environment variables pointing to to a stack of certificates or directory of certificates respectively. Unless the same considerations are made when loading certificates (e.g., ensure only root can write to that path, and all its parent directories), I don't see a reason to single out OS X.

dndx · 2016-02-26T18:19:49Z

Yeah I can see your point, it seems unnecessary to limit the current user from using his/her own keychain as a trusted storage.

Also note that if the target machine has cgo available, root_cgo_darwin.go will be used instead which in turn uses the SecTrustCopyAnchorCertificates() function to obtain a list of all trusted roots. On my machine that function returned 192 certs and does not appears to be including those ones from login or System. The returned certs seems to came from /System/Library/Keychains/X509Anchors as documented by Apple and is not necessarily the same as what's inside /System/Library/Keychains/SystemRootCertificates.keychain.

hinman · 2016-03-02T01:07:38Z

I have a potential fix here:
https://github.com/hinman/go/commit/e3e9ebf21b8f949d9b3eaed95e61640e3430ad27

I'll work on https://golang.org/doc/contribute.html if no one else has a proposed solution.

Basically I'm copying all the trusted certificates from the System, Admin & User domains and then filtering out all the ones where the subject and issuer names don't match (not a root CA or self signed cert).

gopherbot · 2016-03-08T05:00:33Z

CL https://golang.org/cl/20351 mentions this issue.

Allows configuration of the CA certs for the Atlas connection via environment variables `ATLAS_CAFILE` or `ATLAS_CAPATH`. Also catches the workaround for golang/go#14514 in go-rootcerts so that OS X clients behave properly.

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

phinze · 2016-05-03T23:02:40Z

Hello friends! As you might have guessed from the above linked-issue noise - I made a package today to work around this issue in Packer and Terraform.

I'm hoping to convert the basic strategy into a Go patch soon, but in the meantime you can check out the package here: https://github.com/hashicorp/go-rootcerts

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

phinze · 2016-05-18T16:47:08Z

Hi folks - great to see @hinman's patch landing, thank you for that work!

Because it's a cgo-only solution, this does not solve the problem for our use case. I'm not sure what the intent of this particular issue is - should a cgo-free story here be a separate issue or should this one be reopened?

bradfitz · 2016-05-18T16:55:48Z

New bug.

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

wmarbut · 2016-06-16T20:58:59Z

@phinze Yeah, I'm in the same boat. The cgo only solution doesn't work for me.

ianlancetaylor · 2016-06-16T21:14:45Z

@grep-awesome This issue is closed. Please open a new issue or discuss this in a forum (https://golang.org/wiki/Questions).

gopherbot · 2020-04-14T21:27:04Z

Change https://golang.org/cl/227037 mentions this issue: crypto/x509: use Security.framework without cgo for roots on macOS

ianlancetaylor added this to the Go1.7 milestone Feb 26, 2016

ianlancetaylor added the OS-Darwin label Feb 26, 2016

jmprice mentioned this issue Mar 8, 2016

Mac users getting "Invalid SSL Cert" error in version 6.16 cloudfoundry/cli#791

Closed

jefferai mentioned this issue Apr 15, 2016

certificate issue on darwin hashicorp/vault#1334

Closed

arunanc mentioned this issue Apr 15, 2016

Problems using a custom boot2docker ISO hosted on an internal HTTPS site with self-signed cert docker/machine#491

Open

phinze mentioned this issue May 3, 2016

Use go-rootcerts to configure TLS hashicorp/atlas-go#52

Merged

phinze added a commit to hashicorp/terraform that referenced this issue May 3, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

355240b

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

phinze mentioned this issue May 3, 2016

atlas: Use go-rootcerts for certificate loading hashicorp/terraform#6453

Merged

phinze added a commit to hashicorp/terraform that referenced this issue May 3, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

4ac6dda

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

bigkraig pushed a commit to ticketmaster/terraform that referenced this issue May 5, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

9793400

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

bigkraig pushed a commit to ticketmaster/terraform that referenced this issue May 5, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

ad4650a

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

xsellier pushed a commit to xsellier/terraform that referenced this issue May 17, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

f57f25c

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

rsc modified the milestones: Go1.8, Go1.7 May 18, 2016

gopherbot closed this as completed in 6cd698d May 18, 2016

cristicalin pushed a commit to cristicalin/terraform that referenced this issue May 24, 2016

state/remote/atlas: Use go-rootcerts for certificate loading

41bbd41

Allows CA certs to be configured via `ATLAS_CAFILE` and `ATLAS_CAPATH` env vars, and works around golang/go#14514 on OS X.

skeet70 mentioned this issue May 26, 2016

Unknown CA Authority for Github Enterprise mislav/hub#852

Open

mgilbir mentioned this issue May 30, 2016

OSX docker client fails to use keychain registered certificates moby/moby#23105

Closed

golang locked and limited conversation to collaborators Jun 23, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

crypto/x509: root_darwin.go does not include trusted root certificates from System/Login keychains #14514

crypto/x509: root_darwin.go does not include trusted root certificates from System/Login keychains #14514

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!