cert.pem

-----BEGIN CERTIFICATE-----
MIIDPzCCAiegAwIBAgIUHDx4FbvRISzuQcMBM78XW3fmzlUwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE1MTIxNDE3NDY1OFoXDTE1MTIx
NzE3NDY1OFowFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEArj3DK+XkPH4KKsB8qFzoLcNQf9wf+Pcp92sfY2/2T3Mw
+nkO5jjPGRQbshkU2WUe59uvaviUC8AdlazwJk4vi5H1n5ZMLfBjXZffhd0nJcsR
mHQJix/8jtBYlpzHv/4tVa9k3v+QA3yjfj6o9kpt5FA1wYmoiMd40aCwX1qWRVRD
HpUCh2+gIldj8y/GNEpxwTjPA1GAtxkkD+OS/mEV6Rse4et9D6uQoa69OvDtOyR1
sNofuORiQ47MPNF56wNSGdrBFxFWErkZqYdYdAaqjOei9kdDmQ74C9rY6hkEvYO+
Vkp3pYWj3Y5BQIUZa5DGBzmPlXWqKWfj7L+PlZww5QIDAQABo4GIMIGFMA4GA1Ud
DwEB/wQEAwIDqDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0O
BBYEFE0oYZpTLZ/fmdb+5ixUM+BJXJnIMB8GA1UdIwQYMBaAFLKWyE6ZVGxRYOVI
5zlKgCr82ihlMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOC
AQEAqvLes08wVuxidwGvV6wFBlOIpICdZiRtkK96oYGsSIaSlptJAj6DDMAJgs1C
WA8k2KQN/O/E0ZmOoJpukQ8+L08yJxxdZmZ94IVkvQKu6ujggTMYHr5bu2cOgY6I
FhBToFRDQkNH27a3WSoEMD/1AypfZOxD9ADA65i8Y/edatNMXYbYgg6ky/7Oi8QE
d5L+5l8FAl9KjRGlAI1DD6gKbgfLCrZpWqKpFg/WVb8hvQ1NGWVLA4fniCzLw3Fj
fxXESrhNqKuwuVrwFDMryODugAul4RYOyiN/wwnzaoKwupEcDabPelweTzIkCr5Q
aB0Qxo1xNgwd2sYauUAdJFaweQ==
-----END CERTIFICATE-----

key.pem

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEArj3DK+XkPH4KKsB8qFzoLcNQf9wf+Pcp92sfY2/2T3Mw+nkO
5jjPGRQbshkU2WUe59uvaviUC8AdlazwJk4vi5H1n5ZMLfBjXZffhd0nJcsRmHQJ
ix/8jtBYlpzHv/4tVa9k3v+QA3yjfj6o9kpt5FA1wYmoiMd40aCwX1qWRVRDHpUC
h2+gIldj8y/GNEpxwTjPA1GAtxkkD+OS/mEV6Rse4et9D6uQoa69OvDtOyR1sNof
uORiQ47MPNF56wNSGdrBFxFWErkZqYdYdAaqjOei9kdDmQ74C9rY6hkEvYO+Vkp3
pYWj3Y5BQIUZa5DGBzmPlXWqKWfj7L+PlZww5QIDAQABAoIBAC4fYz6HiDcLFh3i
/hyDG2KhxPlTh5MbuhwoWxKzXHwDff+PdAY1G30D+aDXStGRFvFBEdo7GtVRcYNh
V+CL6cIETQSFgHzYmTT5Ms34kJhMfMfiT3Roby5OsGSN88I6wj1gRE9TTwfdQln0
tD0dzqEVKmWkztwGEVFMO+PB0u1exKqfAWFMcMItCbffs8BIpDDneM3tSugiCNwz
YYXcOXcdSdZikLnNisamY6nFHUEOMwFFHSlS/PRcXmuRCN+ymjbM6SIKUY+Ol/hf
a51CgIw59bQz/JQxW8Y3OGwdg4AQC+N/9yfFEw0cCwg62QQme8tQL+6MOQKEP3CD
9EDsPwECgYEA4SqgfVhnnpUHr50jlWgKy+6ImukYbeWLVClM7Vs5CBSqmqFteSPe
GyWb9Ja2gptOM3VG/kMl6w2En7uWx6Lh4Xreg6okOW1g8JIDLVJ2urN8fMs6Pb6n
gLyR92BtLv0IXVqs8rWZXdw9sV/6bioMKT4QRXlGQEBGJ+FTJ9Ir/7ECgYEAxhnq
EoyAzc5GBowYaiwaRtNmzsqfpmyLftLesYre3tqn3q+iVHzMY00wUneXom6Ot5YP
s2XN9MVlkMrnKq+c1k3G8Idg3qPOsZPWCgHGRipd1uwLTK7QTGdDtOxV9NX5dg/s
ONr3CKTVMYxITePZfnp6hZGliIFYArBLdPj35XUCgYEAuIhEyzU+hprAl84CsZl4
77Tnw30xBi/PRgQrBYNzdAnr35pYq6UXi8wAyi0SGmvJZSbCLfM+Cisj+/yzD52P
3UjjP6ia022uuroPXH9uyof6iBPOAXhUso7YWZJvKMk6p7d+cdMeg+vRq6JrDQns
uYghsa44QsPqOxjRG5uFb6ECgYAweosDuwqSUtZkJ8iZwu0zQ+y20nM7YPjKMoR4
4kkkNFI8drK9BkVmT69xnv6mq3OVjc2N024RZnUyd9UWZx90elgi6J5WHbQpVMpe
bIy/AwMv41fojic/a03wap2mau6/a6odR8iIfv4FQBU5qnbBMuvk3/2oaC7HiakN
mRfhOQKBgC77bpb063cO8TM/ZvCMo20DAjL3yCbjr9sMZvtvCFH90uZtmIAcKC6M
yoeXM95xObElm7Vjn+DInPyWuGZfD5RbDx0f5504LyRgP13P4ZKqKq8HYo9LiSfV
NMchTj0/Mx2Dw7rMNDyWnEGtify8UTipqEb8MrqcNx4FHPJNLfcr
-----END RSA PRIVATE KEY-----

root.pem

-----BEGIN CERTIFICATE-----
MIIDRjCCAi6gAwIBAgIUMZfNq+9CaOF8tW0dVArjlExlFrkwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE1MTIxNDE3NDY0OVoXDTI1MTIx
MTE3NDY0OVowFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAy6daLctcP3/eu9K8uZhqYVFQ1yEFjcCbd3XibnVXz2NE
ejJsGCq6PISSjovsZUuVQwSwojAbzyU3X3LYAUp9RxsIkwLGdK18X/mASeHz1I7t
iV3eTYjOEFQ9fybw++h1C/RgN6/kWX0O1tdgqH+zG4T1e3PD7DrCZIWkxTpEK9Nm
e4ylAsRWRP3qeysm73Bim7rW+8iMeV66IXRVFcBlSyr5cMeBRK7wef7H6DEu1haz
wC+YGbTt6eGvgVA1+yFEngWpv7RO1EZfhvi/GAUeHb/W0UzYYYKnvqmNBxDEgZBg
bhqAoSrCdJ72naTFp8UfoSvKjED3jqJ3gsMMtB9fQwIDAQABo4GPMIGMMA4GA1Ud
DwEB/wQEAwIBrjATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgNVHRMBAf8EBTADAQH/
MB0GA1UdDgQWBBSylshOmVRsUWDlSOc5SoAq/NooZTAfBgNVHSMEGDAWgBSylshO
mVRsUWDlSOc5SoAq/NooZTAUBgNVHREEDTALgglsb2NhbGhvc3QwDQYJKoZIhvcN
AQELBQADggEBAFP8YQ1bvqkcYz4vgoc/aWdS7qnWTkDjtChICw6mUA/oU7JRWUIR
3yg1f3/KIEeS/ier/RYrdvVogD614OXw8DgMKkcHV368Aa8E1UnSmb4SwL+eOYj+
VmvQnqdZXwMnbhsNBTGXkS2rGJ0/Gp8mHLqVUMwlYO3+55/FCKqFLWrcU1zChcmR
lL4ufCN4cRdkmH2NbdoWKeHgc8jFx6yI3Gt14VuDKp+xFq/aN0EnELtcnfJ01xaa
cJin0WZnAmON/33PGFxA0lWIH8a7q3XayqgflCLY/Hka8FbpX+gAQtGMydY2BR8N
t1ytOT5o7Hal0Rwb7sMsQuMPFyRfmHyDzmk=
-----END CERTIFICATE-----

tlstest.go

// vault server -dev
// vault mount pki
// vault mount-tune -max-lease-ttl=87600h pki
// vault write pki/root/generate/internal common_name=localhost ttl=87600h
// vault write pki/roles/local allowed_domains="localhost" max_ttl="72h"
// vault write pki/issue/local common_name="localhost"
// go run tlstest.go server
// go run tlstest.go client
// panic: x509: certificate specifies an incompatible key usage


package main

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"io/ioutil"
	"os"
)

func main() {
	switch os.Args[1] {
	case `client`:
		client()
	case `server`:
		server()
	}
}

func client() {
	CAPool := x509.NewCertPool()
	rootCert, err := ioutil.ReadFile("root.pem")
	if err != nil {
		panic(err)
	}
	CAPool.AppendCertsFromPEM(rootCert)

	var tlsConfig = &tls.Config{
		RootCAs: CAPool,
	}

	a, err := tls.Dial("tcp", "localhost:9999", tlsConfig)

	if err != nil {
		panic(err)
	}
	stuff, _ := ioutil.ReadAll(a)
	fmt.Println(string(stuff))
}

func server() {
	var cert, err = tls.LoadX509KeyPair("cert.pem", "key.pem")
	if err != nil {
		panic(err)
	}
	var tlsConfig = &tls.Config{
		Certificates: []tls.Certificate{cert},
		ServerName:   `localhost`,
	}

	listener, err := tls.Listen("tcp", ":9999", tlsConfig)
	if err != nil {
		panic(err)
	}
	defer listener.Close()

	for {
		conn, err := listener.Accept()
		if err != nil {
			fmt.Println(err)
		}

		go func() {
			defer conn.Close()
			conn.Write([]byte(`it worked`))
		}()
	}
}