1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
//go:build example && go1.15
// +build example,go1.15
package main
import (
"crypto/tls"
"crypto/x509"
"flag"
"fmt"
"io/ioutil"
"log"
"net"
"net/http"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/s3"
)
// Example of creating an HTTP Client configured with a client TLS
// certificates. Can be used with endpoints such as HTTPS_PROXY that require
// client certificates.
//
// Requires a cert and key flags, and optionally takes a CA file.
//
// To run:
// go run -cert <certfile> -key <keyfile> [-ca <cafile>]
//
// You can generate self signed cert and key pem files
// go run $(go env GOROOT)/src/crypto/tls/generate_cert.go -host <hostname>
func main() {
var clientCertFile, clientKeyFile, caFile string
flag.StringVar(&clientCertFile, "cert", "cert.pem", "The `certificate file` to load.")
flag.StringVar(&clientKeyFile, "key", "key.pem", "The `key file` to load.")
flag.StringVar(&caFile, "ca", "ca.pem", "The `root CA` to load.")
flag.Parse()
if len(clientCertFile) == 0 || len(clientKeyFile) == 0 {
flag.PrintDefaults()
log.Fatalf("client certificate and key required")
}
tlsCfg, err := tlsConfigWithClientCert(clientCertFile, clientKeyFile, caFile)
if err != nil {
log.Fatalf("failed to load client cert, %v", err)
}
// Copy of net/http.DefaultTransport with TLS config loaded
tr := defaultHTTPTransport()
tr.TLSClientConfig = tlsCfg
// Configure the SDK's session with the HTTP client with TLS client
// certificate support enabled. This session will be used to create all
// SDK's API clients.
sess, err := session.NewSession(&aws.Config{
HTTPClient: &http.Client{
Transport: tr,
},
})
// Create each API client will the session configured with the client TLS
// certificate.
svc := s3.New(sess)
resp, err := svc.ListBuckets(&s3.ListBucketsInput{})
if err != nil {
log.Fatalf("failed to list buckets, %v", err)
}
fmt.Println("Buckets")
fmt.Println(resp)
}
func tlsConfigWithClientCert(clientCertFile, clientKeyFile, caFile string) (*tls.Config, error) {
clientCert, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)
if err != nil {
return nil, fmt.Errorf("unable to load certificat files, %s, %s, %v",
clientCertFile, clientKeyFile, err)
}
tlsCfg := &tls.Config{
Certificates: []tls.Certificate{
clientCert,
},
}
if len(caFile) != 0 {
cert, err := ioutil.ReadFile(caFile)
if err != nil {
return nil, fmt.Errorf("unable to load root CA file, %s, %v",
caFile, err)
}
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(cert)
tlsCfg.RootCAs = caCertPool
}
tlsCfg.BuildNameToCertificate()
return tlsCfg, nil
}
func defaultHTTPTransport() *http.Transport {
return &http.Transport{
Proxy: http.ProxyFromEnvironment,
DialContext: (&net.Dialer{
Timeout: 30 * time.Second,
KeepAlive: 30 * time.Second,
DualStack: true,
}).DialContext,
MaxIdleConns: 100,
MaxIdleConnsPerHost: 10, // Increased idle connections per host
IdleConnTimeout: 90 * time.Second,
TLSHandshakeTimeout: 10 * time.Second,
ExpectContinueTimeout: 1 * time.Second,
ForceAttemptHTTP2: true,
}
}
|
