go - TLS Authentication: What does each cert need to contain? -

I'm writing a define.

It works like this:

Post (update)

Put (create)

Delete (Delete)

Methods

Example:

put http: // server1 / key (body = value)

Get the http: // server1 / key

value in the body of the reaction

< P> Now when a put, post is deleted, it duplicates the request and sends it to them, so that each node has the same data and the node is checked, in case of one of the nodes Is unavailable. This header adds, so nodes know that they should not duplicate a request and send it to other nodes.

OK, it works so far, but now I just need to be able to transmit nodes and A WebUI to those nodes and here's the place where TLS comes in play.

As far as I understand I need a root CA, so I can sign the server and client certificate. And I want to get a valid certificate, not "self-signed", because I use Go and Crypto / TLS and should check the certificate.

My question is:

Which extensions or fields require each certificate? I would not want to reproduce the server and client notifications when a new node is added to the config server pool.

I will connect to the IP address, hostname / DNSName (to leave hostname lookups) and potentially conceal third party by specifying an IP for your own DNS, such as s1.myserver. Com My IP is 1.2.3.4 and random friend creates a DNS entry with random.dude.com 1.2.3.4, because I am getting a list of all the nodes, by an NS lookup of clustercfg.mydomain.com) < / P>

On every new node I became a server search (It is true that this is true).

On each new node, I will need to create a client certificate (so I can certify that this customer node is valid and Access to this server node is allowed)

The question is:

  X509v3 extension: X509v3 key usage: important digital signature, key encipherment, certificate sign X50 9 v3 extended key Usage: TLS Web Server Authentication X509v3 Basic Barriers: Important CA: TRUE X509v3 Subject Alternative Name: DNS: server1.myserver.com, IP Address: 2 A02 :: 0: 0: 0: 0: 0: 0: 2, IP Address: 1.2.3.4 < / Code> 

What is the need for a root CAA, a server certificate, a client certificate, so I'm able to "TLS authentication"?

You can use a common server certificate such as web services for servers . Check it properly when you are connected.

For client certificates, how does the client show how to generate and use the certificate?

I used this code for this code, the arrangement of customers contacting the server.

Because you do not have to connect to the IP address, the client will check the server's certificate that matches the hostname which is a very good check.

Hope that helps!