mirror of
https://github.com/Control-D-Inc/ctrld.git
synced 2026-05-27 12:52:27 +02:00
Cuong Manh Le
8e2ef7ca65
Go's default is already TLS 1.2+ (since Go 1.18), but making this explicit satisfies RFC 7858/9250 recommendations and makes the security intent clear for auditors.
29 lines
494 B
Go
29 lines
494 B
Go
package certs
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCACertPool(t *testing.T) {
|
|
c := &http.Client{
|
|
Transport: &http.Transport{
|
|
TLSClientConfig: &tls.Config{
|
|
RootCAs: CACertPool(),
|
|
MinVersion: tls.VersionTLS12,
|
|
},
|
|
},
|
|
Timeout: 2 * time.Second,
|
|
}
|
|
resp, err := c.Get("https://freedns.controld.com/p1")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if !resp.TLS.HandshakeComplete {
|
|
t.Error("TLS handshake is not complete")
|
|
}
|
|
}
|