Lesson 6 of 15 · 40 min

Encrypt the Connection with TLS

Serve both services over HTTPS with the certificates you just made, pin trust to your own certificate authority, and see exactly which of Lesson 4's five weaknesses this fixes.

Learning objectives

List the three guarantees TLS provides and the one it does not.
Walk through a TLS 1.3 handshake and say where possession of the private key is proven.
Serve HTTPS in Go and in Node using a local certificate and key.
Pin client trust to a private CA instead of the system trust store.
Demonstrate that one-way TLS still leaves the server unable to identify its caller.

What TLS does

TLS is the s in https. It does three things:

Service	Was	Now
Go	8091	8443
TypeScript	8092	8444

main.goGo

import (
	"crypto/subtle"
	"crypto/tls"  // NEW
	"crypto/x509" // NEW
	"encoding/json"
	"fmt"
	"io"
	"log"
	"net/http"
	"os" // NEW - to read the CA file
	"strings"
	"time"
)

const (
	port    = "8443"                            // CHANGED
	peerURL = "https://127.0.0.1:8444/health"   // CHANGED - https, new port

	caFile   = "certs/ca.crt"
	certFile = "certs/go.crt"
	keyFile  = "certs/go.key"

	apiKey = "super-secret-shared-key"
)

main.goGo

// trustPool loads our CA into a certificate pool.
func trustPool() (*x509.CertPool, error) {
	pem, err := os.ReadFile(caFile)
	if err != nil {
		return nil, err
	}
	pool := x509.NewCertPool()
	if !pool.AppendCertsFromPEM(pem) {
		return nil, fmt.Errorf("no certificates found in %s", caFile)
	}
	return pool, nil
}

main.goGo

func poll(pool *x509.CertPool) {
	client := &http.Client{
		Timeout: 3 * time.Second,
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				RootCAs:    pool,             // verify the peer against OUR ca
				MinVersion: tls.VersionTLS13, // refuse older, weaker TLS
			},
		},
	}

	// ... the loop body is unchanged from Lesson 3
}

main.goGo

	srv := &http.Server{
		Addr:    "127.0.0.1:" + port,
		Handler: mux,
		TLSConfig: &tls.Config{
			MinVersion: tls.VersionTLS13,
		},
	}

	fmt.Printf("The Go Server is running on port %s  (https, api key required)\n", port)
	go poll(pool)

	// ListenAndServeTLS instead of ListenAndServe. We hand it our certificate.
	log.Fatal(srv.ListenAndServeTLS(certFile, keyFile))

main.goGo

package main

import (
	"crypto/subtle"
	"crypto/tls"
	"crypto/x509"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"net/http"
	"os"
	"strings"
	"time"
)

const (
	port    = "8443" // 8443 by convention means "HTTPS, not on the real 443"
	peerURL = "https://127.0.0.1:8444/health"

	caFile   = "certs/ca.crt"
	certFile = "certs/go.crt"
	keyFile  = "certs/go.key"

	apiKey = "super-secret-shared-key"
)

func checkKey(given string) bool {
	return subtle.ConstantTimeCompare([]byte(given), []byte(apiKey)) == 1
}

// trustPool loads our CA into a certificate pool.
//
// Using this instead of the system default matters: by default a Go client
// trusts every public CA on earth, so a certificate bought from any of them
// would be accepted. We want exactly one issuer.
func trustPool() (*x509.CertPool, error) {
	pem, err := os.ReadFile(caFile)
	if err != nil {
		return nil, err
	}
	pool := x509.NewCertPool()
	if !pool.AppendCertsFromPEM(pem) {
		return nil, fmt.Errorf("no certificates found in %s", caFile)
	}
	return pool, nil
}

func health(w http.ResponseWriter, r *http.Request) {
	if !checkKey(r.Header.Get("X-API-Key")) {
		log.Printf("<-  (unknown)     GET /health  DENIED: bad or missing api key")
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusUnauthorized)
		_ = json.NewEncoder(w).Encode(map[string]string{"error": "unauthorized"})
		return
	}

	// Encrypted now -- but we still only know the caller had the key.
	log.Printf("<-  (has key)     GET /health")

	w.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(w).Encode(map[string]string{
		"service": "go",
		"status":  "ok",
	})
}

func poll(pool *x509.CertPool) {
	client := &http.Client{
		Timeout: 3 * time.Second,
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				RootCAs:    pool, // verify the peer's certificate against our CA
				MinVersion: tls.VersionTLS13,
			},
		},
	}

	for {
		time.Sleep(3 * time.Second)

		req, err := http.NewRequest(http.MethodGet, peerURL, nil)
		if err != nil {
			log.Printf("--> ts            %v", err)
			continue
		}
		req.Header.Set("X-API-Key", apiKey)

		resp, err := client.Do(req)
		if err != nil {
			log.Printf("--> ts            unreachable: %v", err)
			continue
		}

		body, err := io.ReadAll(resp.Body)
		resp.Body.Close()
		if err != nil {
			log.Printf("--> ts            reply unreadable: %v", err)
			continue
		}

		log.Printf("--> ts            %s %s", resp.Status, strings.TrimSpace(string(body)))
	}
}

func main() {
	log.SetFlags(log.Ltime)

	pool, err := trustPool()
	if err != nil {
		log.Fatalf("tls setup failed (run ./gen-certs.sh first): %v", err)
	}

	mux := http.NewServeMux()
	mux.HandleFunc("/health", health)

	srv := &http.Server{
		Addr:    "127.0.0.1:" + port,
		Handler: mux,
		TLSConfig: &tls.Config{
			MinVersion: tls.VersionTLS13,
		},
	}

	fmt.Printf("The Go Server is running on port %s  (https, api key required)\n", port)
	go poll(pool)

	// ListenAndServeTLS is the only difference from Lesson 3's ListenAndServe:
	// we hand it the certificate we present to callers.
	log.Fatal(srv.ListenAndServeTLS(certFile, keyFile))
}

server.tsTypeScript

import { createServer, request } from "node:https"; // node:https, not node:http
import { readFileSync } from "node:fs";
import { timingSafeEqual } from "node:crypto";

const PORT = 8444;
const PEER_URL = "https://127.0.0.1:8443/health";

const ca = readFileSync("certs/ca.crt");
const cert = readFileSync("certs/ts.crt");
const key = readFileSync("certs/ts.key");

const API_KEY = "super-secret-shared-key";
// Every outbound call gets a deadline and a size cap. Node gives you neither
// by default: without them, a peer that accepts the connection and then goes
// quiet holds a request open forever.
const REQUEST_TIMEOUT_MS = 3000;
const MAX_RESPONSE_BYTES = 64 * 1024;

server.tsTypeScript

function httpsGet(
  url: string,
  options: { ca: Buffer; headers?: Record<string, string> },
): Promise<{ status: number; body: string }> {
  return new Promise((resolve, reject) => {
    const req = request(
      url,
      { ca: options.ca, headers: options.headers, minVersion: "TLSv1.3" },
      (res) => {
        let body = "";
        let received = 0;
        res.on("data", (chunk) => {
          // Count BYTES off the wire, before any decoding. `string.length`
          // counts UTF-16 code units, which is a different number.
          received += chunk.length;
          if (received > MAX_RESPONSE_BYTES) {
            req.destroy(new Error("response too large"));
            return;
          }
          body += chunk;
        });
        res.on("end", () => {
          clearTimeout(deadline);
          resolve({ status: res.statusCode ?? 0, body });
        });
      },
    );
    // One overall deadline. Go's http.Client.Timeout covers the whole request;
    // Node has no equivalent by default, so we build it.
    const deadline = setTimeout(
      () => req.destroy(new Error("request deadline exceeded")),
      REQUEST_TIMEOUT_MS,
    );
    req.on("error", (error) => {
      clearTimeout(deadline);
      reject(error);
    });
    req.end();
  });
}

server.tsTypeScript

import { createServer, request } from "node:https";
import { readFileSync } from "node:fs";
import { timingSafeEqual } from "node:crypto";

const PORT = 8444; // 8444 by convention means "HTTPS, not on the real 443"
const PEER_URL = "https://127.0.0.1:8443/health";

const ca = readFileSync("certs/ca.crt");
const cert = readFileSync("certs/ts.crt");
const key = readFileSync("certs/ts.key");

const API_KEY = "super-secret-shared-key";
// Every outbound call gets a deadline and a size cap. Node gives you neither
// by default: without them, a peer that accepts the connection and then goes
// quiet holds a request open forever.
const REQUEST_TIMEOUT_MS = 3000;
const MAX_RESPONSE_BYTES = 64 * 1024;

function log(message: string) {
  console.log(new Date().toTimeString().slice(0, 8), message);
}

function checkKey(given: string): boolean {
  const a = Buffer.from(given);
  const b = Buffer.from(API_KEY);
  return a.length === b.length && timingSafeEqual(a, b);
}

// A small promise wrapper around https.request.
//
// We cannot use fetch() from here on, because fetch gives us no way to say
// "trust this CA" or (in Lesson 7) "present this client certificate".
function httpsGet(
  url: string,
  options: { ca: Buffer; headers?: Record<string, string> },
): Promise<{ status: number; body: string }> {
  return new Promise((resolve, reject) => {
    const req = request(
      url,
      { ca: options.ca, headers: options.headers, minVersion: "TLSv1.3" },
      (res) => {
        let body = "";
        let received = 0;
        res.on("data", (chunk) => {
          // Count BYTES off the wire, before any decoding. `string.length`
          // counts UTF-16 code units, which is a different number.
          received += chunk.length;
          if (received > MAX_RESPONSE_BYTES) {
            req.destroy(new Error("response too large"));
            return;
          }
          body += chunk;
        });
        res.on("end", () => {
          clearTimeout(deadline);
          resolve({ status: res.statusCode ?? 0, body });
        });
      },
    );
    // One overall deadline. Go's http.Client.Timeout covers the whole request;
    // Node has no equivalent by default, so we build it.
    const deadline = setTimeout(
      () => req.destroy(new Error("request deadline exceeded")),
      REQUEST_TIMEOUT_MS,
    );
    req.on("error", (error) => {
      clearTimeout(deadline);
      reject(error);
    });
    req.end();
  });
}

// createServer now comes from node:https and takes our certificate.
const server = createServer({ cert, key, minVersion: "TLSv1.3" }, (req, res) => {
  if (req.url !== "/health") {
    res.writeHead(404);
    res.end();
    return;
  }

  const given = req.headers["x-api-key"];
  if (typeof given !== "string" || !checkKey(given)) {
    log("<-  (unknown)     GET /health  DENIED: bad or missing api key");
    res.writeHead(401, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "unauthorized" }));
    return;
  }

  // Encrypted now -- but we still only know the caller had the key.
  log("<-  (has key)     GET /health");

  res.writeHead(200, { "Content-Type": "application/json" });
  res.end(JSON.stringify({ service: "typescript", status: "ok" }));
});

async function poll() {
  while (true) {
    await new Promise((r) => setTimeout(r, 3000));
    try {
      // Passing `ca` replaces the system trust store. Without it, a certificate
      // from any public CA on earth would be accepted.
      const res = await httpsGet(PEER_URL, { ca, headers: { "X-API-Key": API_KEY } });
      log(`--> go            ${res.status} ${res.body.trim()}`);
    } catch (error) {
      log(`--> go            unreachable: ${error}`);
    }
  }
}

server.listen(PORT, "127.0.0.1", () => {
  console.log(`The TypeScript Server is running on port ${PORT}  (https, api key required)`);
  poll();
});

go output

The Go Server is running on port 8443  (https, api key required)
17:22:14 <-  (has key)     GET /health
17:22:14 --> ts            200 OK {"service":"typescript","status":"ok"}

Weakness	Status after this lesson
Travels in plain text	Fixed
Proves possession, not identity	Unchanged
Both sides hold the same secret	Unchanged
Rotation needs a coordinated deploy	Unchanged
Leaks everywhere	Unchanged

Error	Meaning	Fix
`unable to get local issuer certificate`	The client does not trust the CA	Pass `--cacert certs/ca.crt`, or set `ca:` / `RootCAs:` in code
`certificate is valid for localhost, not X`	The name inside does not match what you dialed	Add the name to `subjectAltName` in `gen-certs.sh` and rerun
`no such file or directory: certs/ca.crt`	Script not run, or wrong working directory	Run `./gen-certs.sh` from inside `secure-services`
`http: server gave HTTP response to HTTPS client`	You used `https://` against a plain-HTTP listener	Check the port and the scheme
`certificate has expired`	Exactly what it says	Rerun `./gen-certs.sh`

Encrypt the Connection with TLS

Learning objectives

What TLS does

Encrypt the Connection with TLS

Learning objectives

What TLS does

What actually happens on the wire

New ports

Go: serve over HTTPS

New imports and constants

Load the CA we trust

Use it when calling out

Serve over TLS from Go

The complete Go file

TypeScript: the same

Imports and files

Say goodbye to fetch

Serve over TLS from Node

Use the CA when calling out

The complete TypeScript file

Run it and test

Test 1: plain HTTP is gone

Test 2: curl does not trust our CA

Test 3: tell curl about our CA

What you did not fix

Common errors

Lesson 6 checkpoint