Golang连接MySQL SSL遇x509证书域名不匹配问题求助

问题现象 #

连接MySQL时收到以下错误：

x509: certificate is valid for *.abc-xy-pxc, not <db_host>

注：abc-xy是db_host的一部分，abc_xy是数据库名称。

原代码实现 #

创建TLS配置的函数 #

func createTLSConf() tls.Config {

    rootCertPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("certificate.pem")
    if err != nil {
        log.Fatal(err)
    }
    if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
        log.Fatal("Failed to append PEM.")
    }
    clientCert := make([]tls.Certificate, 0, 1)

    certs, err := tls.LoadX509KeyPair("certificate.pem", "privkey.pem")
    if err != nil {
        log.Fatal(err)
    }

    clientCert = append(clientCert, certs)

    return tls.Config{
        RootCAs:            rootCertPool,
        Certificates:       clientCert,
        InsecureSkipVerify: false,
    }
}

数据库连接代码 #

tlsConf := createTLSConf()  
err := mysql.RegisterTLSConfig("custom", &tlsConf)

if err != nil {
    log.Printf("Error %s when RegisterTLSConfig\n", err)
    return
}

dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?tls=custom", "user", "pass", "db_host", "db_name")
db, err := sql.Open("mysql", dsn)

if err != nil {
    log.Printf("Error %s when opening DB\n", err)
    log.Printf("%s", dsn)
    return
}

连接测试代码 #

defer db.Close()

e := db.Ping()
fmt.Println(dsn, e)

db.Close()

调试操作及结果 #

1. 原配置运行时输出：

<user>:<pass>@tcp(<db_host>)/<db_name>?tls=custom x509: certificate is valid for *.abc-xy-pxc, not <db_host>

2. 将InsecureSkipVerify改为true后，出现新错误：

[mysql] 2022/10/21 22:31:27 packets.go:37: remote error: tls: unknown certificate authority

解决方法 #

移除客户端证书相关代码，同时保持InsecureSkipVerify为true，修改后的createTLSConf函数如下：

func createTLSConf() tls.Config {

    rootCertPool := x509.NewCertPool()
    pem, err := ioutil.ReadFile("certificate.pem")
    if err != nil {
        log.Fatal(err)
    }
    if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
        log.Fatal("Failed to append PEM.")
    }

    return tls.Config{
        RootCAs:            rootCertPool,
        InsecureSkipVerify: true, // needed for self signed certs
    }
}

内容的提问来源于stack exchange，提问作者Szymon Biernacki