Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Golang to the Rescue: Saving DevOps from TLS Tu...

Golang to the Rescue: Saving DevOps from TLS Turmoil

GopherCon 2017 Lightning Talk by Chris Short

Chris Short

July 15, 2017
Tweet

More Decks by Chris Short

Other Decks in Programming

Transcript

  1. Golang to the rescue: Saving DevOps from TLS turmoil GopherCon

    2017 Lightning Talk Chris Short Manager of DevOps at Bankrate
  2. Introduction Chris Short Manager of DevOps at Bankrate (http://www.bankrate.com) opensource.com

    (https://opensource.com/users/chrisshort) and DZone (https://dzone.com/users/2868764/chrisshort.html) Contributor Contributed to The Open Organization Guide to IT Culture Change (https://opensource.com/open- organization/resources/culture-change) DevOpsDays (https://www.devopsdays.org/) Speaker and Organizer DevOps'ish (https://devopsish.com/) chrisshort.net (https://chrisshort.net) @ChrisShort (https://twitter.com/ChrisShort) This talk was derived from an opensource.com article I wrote in April 2017: Golang to the rescue: Saving DevOps from TLS turmoil (https://opensource.com/article/17/4/testing-certi cate-chains-34-line-go-program)
  3. So What Does Any Good Engineer Do? Go Build by

    Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  4. Three Go Packages: log The go log (https://golang.org/pkg/log/) package is

    pretty self explanatory Package that enables logging Needed a spectacular failure at the sign of trouble log has three helper functions: print, fatal, and panic Output from the package goes to stderr Used a fatal error to get the web server to stop and log any issue Hugging Gophers by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  5. Three Go Packages: crypto/tls The Go crypto/tls (https://golang.org/pkg/crypto/tls/) package partially

    implements TLS 1.2, as speci ed in RFC 5246 (https://tools.ietf.org/html/rfc5246) Package con gures usable SSL/TLS versions Identi es preferred cipher suites and elliptic curves used during handshakes This is the package that handles connections securely Gopher Star Wars by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  6. Three Go Packages: net/http Go implementation of HTTP net/http (https://golang.org/pkg/net/http/)

    has a function called ListenAndServeTLS ListenAndServeTLS provides the desired certi cate checking functionality "If the certi cate is signed by a certi cate authority, the certFile should be the concatenation of the server's certi cate, any intermediates, and the CA's certi cate." Gopher Inclusion by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  7. main: mux, cfg, srv Code creates a mux, short for

    HTTP request multiplexer I ❤ multiplexers (it's a long story that involves analog signals) mux has a function that creates an HTTP server with headers and content (Hello World!) cfg brings in all the TLS bits seen in a solid web server con g srv puts the pieces together and de nes what port to listen on Gopher Share by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  8. Fail Spectacularly I ❤ DevOps I embrace failure log.Fatal(srv.ListenAndServeTLS("/etc/ssl-tester/tls.crt", "/etc/ssl-

    tester/tls.key")) De nes path of certi cate les to use Also logs a fatal error if certi cate is not valid Fails Fast
  9. Conclusion The Go code does exactly what I need it

    to do and nothing more About 40 lines of code!!! I ❤ Go! Binary is a self contained web server Less than 6MB!!! I ❤ Go! Can be safely deployed to any public server External testing run against it for extra vetting Gopher Mic Drop by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
  10. Thank you Chris Short Manager of DevOps at Bankrate [email protected]

    (mailto:[email protected]) https://devopsish.com (https://devopsish.com) @ChrisShort (http://twitter.com/ChrisShort)