TLS connection timeout problem

[silence44]

I'm trying to set websocket connection from one golang app to another one using tls.

On client side I do just simple connect:

u := url.URL{Scheme: "wss", Host: "localhost:8000", Path: "/server_client"}
conn, _, err := websocket.DefaultDialer.Dial(u.String(), nil)
log.Info("Tried connect...")

On server side I have gin gonic with TLS:

r := gin.Default()

r.GET("/server_client", func(c *gin.Context) {
	s.wshandler(hub, c.Writer, c.Request)
})

return r.RunTLS(":8000", certFilePath, keyFilePath)

And problem that code on client side just stay on dialing forever. I mean that I can't see log "Tried connect...".

After 10 minutes I killed client app process I saw on server side this message:
"http: TLS handshake error from [::1]:50194: read tcp [::1]:8000->[::1]:50194: read: connection reset by peer"

All the time I was using my local certificate and after few hours I fixed issue with custom dialer config where I set:

TLSClientConfig: &tls.Config{InsecureSkipVerify: true}

Anyway without it my code was waiting forever for something I don't understand. I think it still may be an issue for somebody. Please tell me how I can help you to provide more details about my issue.

[ghost]

Show the client code that is "using my local certificate".

Kill the client with SIGQUIT to dump the goroutine stack traces and share the trace of the dialing goroutine here. To kill with SIGQUIT, type ctrl-backslash on the terminal.

[silence44]

Ok, right now I rolled back my code to repeat the issue and now it does not stuck any more.

So I'm receiving normal error from dialing with message: "ERRO[0004] x509: certificate is valid for Test, not localhost". Which is normal behaviour I think.

I suppose It may be my antivirus holding connection or smth.

To my mind we can close this issue for now.

[elithrar]

Your certificate just isn’t valid, as it’s not signed by a root CA that your machine (and thus, Go) can validate. I can highly recommend mkcert (https://github.com/FiloSottile/mkcert) for helping set up valid test certificates that don’t require you to set InsecureSkipVerify (a dangerous setting to forget about!) in the client.

…

On Tue, Sep 4, 2018 at 5:41 AM Denys Lishchenko ***@***.***> wrote: Ok, right now I rolled back my code to repeat the issue and now it does not stuck any more. So I'm receiving normal error from dialing with message: "ERRO[0004] x509: certificate is valid for Test, not localhost". Which is normal behaviour I think. I suppose It may be my antivirus holding connection or smth. To my mind we can close this issue for now. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#420 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABIcBQfU7ITfeUibz7M1ZZeLRvNZ6Itks5uXnTogaJpZM4WY31R> .

[silence44]

I knew that it was not valid. I was expecting to get "invalid error". But the point was that on dial program just stucked and was not able to move forward. Now somehow I can't reproduce this.

P.s. Thanks for mkcert, will check it out later.

[elithrar]

Also look at using the new DialContext - as of https://github.com/gorilla/websocket/releases/tag/v1.4.0 - that will let you add a context with a deadline to your client connections.

…

On Tue, Sep 4, 2018 at 7:23 AM Denys Lishchenko ***@***.***> wrote: I knew that it was not valid. I was expecting to get "invalid error". But the point was that on dial program just stucked and was not able to move forward. Now somehow I can't reproduce this. P.s. Thanks for mkcert, will check it out later. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#420 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABIcPMAVS-XEkfA3zwPDdF6V1DBtT_qks5uXozEgaJpZM4WY31R> .

[ghost]

PR #429 includes a test with an invalid certificate. The test does not hang.

@silence44 Please share anything you can on how to reproduce this problem.

[silence44]

As I mentioned above I can't reproduce it anymore by myself.
I think that was my antivirus blocking program execution with not valid certificate.

To my mind we can close this issue.