{"id":16878797,"url":"https://github.com/peterj/mtlstester","last_synced_at":"2026-05-18T03:34:26.069Z","repository":{"id":65593240,"uuid":"595364819","full_name":"peterj/mtlstester","owner":"peterj","description":"Simple Go app to showcase mutual TLS (mTLS)","archived":false,"fork":false,"pushed_at":"2023-01-30T23:57:05.000Z","size":12,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-08-31T03:49:06.694Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/peterj.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2023-01-30T23:30:34.000Z","updated_at":"2023-01-30T23:30:50.000Z","dependencies_parsed_at":"2023-02-16T12:55:21.447Z","dependency_job_id":null,"html_url":"https://github.com/peterj/mtlstester","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/peterj/mtlstester","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peterj%2Fmtlstester","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peterj%2Fmtlstester/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peterj%2Fmtlstester/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peterj%2Fmtlstester/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/peterj","download_url":"https://codeload.github.com/peterj/mtlstester/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peterj%2Fmtlstester/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33163760,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-17T22:39:12.733Z","status":"online","status_checked_at":"2026-05-18T02:00:06.436Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T15:51:26.799Z","updated_at":"2026-05-18T03:34:26.050Z","avatar_url":"https://github.com/peterj.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mTLS Tester\n\nThis repo contains a simple Go app that can run in client or server mode, for the purpose of showing how mTLS works.\n\nBoth modes accept the cert and private key, as well as the CA certificate.\n\nTo test the mTLS, both client and server need to use certificates issued by the CA. To generate all certificates, run the following (make sure to provide a password when prompted):\n\n```shell\n# CA cert\nopenssl req -x509 -sha256 -days 90 -newkey rsa:2048 -addext basicConstraints=critical,CA:TRUE,pathlen:1 -subj '/O=ACME CA Inc./CN=CA' -keyout ca-key.pem -out ca-crt.pem\n\n# Server cert\nopenssl genrsa -out server-key.pem 4096\nopenssl req -new -subj \"/CN=server\" -key server-key.pem -out server-csr.pem\nopenssl x509 -req -days 90 -in server-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out server-crt.pem   -extensions SAN -extfile \u003c(cat /etc/ssl/openssl.cnf \u003c(printf \"\\n[SAN]\\nsubjectAltName=DNS:localhost\"))\n\n# Client cert\nopenssl genrsa -out client-key.pem 4096\nopenssl req -new -subj \"/CN=client\" -key client-key.pem -out client-csr.pem\nopenssl x509 -req -days 90 -in client-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out client-crt.pem   -extensions SAN -extfile \u003c(cat /etc/ssl/openssl.cnf \u003c(printf \"\\n[SAN]\\nsubjectAltName=DNS:localhost\"))\n```\n\nIf you use the above snippet and the default file names, you can run the app without providing any extra flags.\n\nTo run the server:\n\n```shell\ngo run main.go --run server\n```\n\n```console\n2023/01/30 15:01:29 Loading CA: ca-crt.pem\n2023/01/30 15:01:29 Running client\n2023/01/30 15:01:29 Loading key pair: server-crt.pem server-key.pem\n2023/01/30 15:01:29 Using certificate: CN: server SAN: [localhost]\n2023/01/30 15:01:29 Listening for requests on port 8443\n```\n\nIn a separate terminal, run the client that will make an mTLS request with the server:\n\n```shell\ngo run main.go --run client\n```\n\n```console\n2023/01/30 15:02:28 Loading CA: ca-crt.pem\n2023/01/30 15:02:28 Loading key pair: client-crt.pem client-key.pem\n2023/01/30 15:02:28 Using certificate: CN: client SAN: [localhost]\n2023/01/30 15:02:28 Making request to https://localhost:8443/hello\nReceived response: Hello world%\n```\n\nOn the server-side, you'll notice the request was received and the client certificate details:\n\n```console \n2023/01/30 15:02:28 Request received\n2023/01/30 15:02:28     Client certificate: CN: client SAN: [localhost]\n```\n\n## Running using Docker\n\nYou can also run the app in the Docker containers. We use `host` network, so the client can call the server using `localhost`. Theoretically, you could use other host name, but then you'll have to make sure to include the DNS names in the `subjectAltName` when creating the certificates.\n\n\nThe commands assume you have the certs created in the same folder where you're running these commands.\n\nTo run the server:\n\n```shell\ndocker run --net host -v $PWD:/certs ghcr.io/peterj/mtlstester:latest --run server --caCertFile certs/ca-crt.pem --serverCertFile certs/server-crt.pem --serverKeyFile certs/server-key.pem\n```\n\nThe above command exposes the server on the default port (`8443`) from the host.\n\nYou can run the client like this:\n\n```shell\ndocker run --net host -v $PWD:/certs ghcr.io/peterj/mtlstester:latest --run client --caCertFile certs/ca-crt.pem --clientCertFile certs/client-crt.pem --clientKeyFile certs/client-key.pem\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpeterj%2Fmtlstester","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpeterj%2Fmtlstester","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpeterj%2Fmtlstester/lists"}