Golang to the Rescue: Saving DevOps from TLS Turmoil

GopherCon 2017 Lightning Talk by Chris Short

Transcript

1. Golang to the rescue: Saving DevOps from TLS turmoil GopherCon 2017 Lightning Talk Chris Short Manager of DevOps at Bankrate
2. Introduction Chris Short Manager of DevOps at Bankrate (http://www.bankrate.com) opensource.com (https://opensource.com/users/chrisshort) and DZone (https://dzone.com/users/2868764/chrisshort.html) Contributor Contributed to The Open Organization Guide to IT Culture Change (https://opensource.com/open- organization/resources/culture-change) DevOpsDays (https://www.devopsdays.org/) Speaker and Organizer DevOps'ish (https://devopsish.com/) chrisshort.net (https://chrisshort.net) @ChrisShort (https://twitter.com/ChrisShort) This talk was derived from an opensource.com article I wrote in April 2017: Golang to the rescue: Saving DevOps from TLS turmoil (https://opensource.com/article/17/4/testing-certi cate-chains-34-line-go-program)
3. But Most Importantly Me in Gopher Form by Gopherize.me (https://gopherize.me/)
4. Not Too Long Ago in a Place of Work Far, Far Away...
6. Let's Talk Certi cate Chains 2 Chainz (we can talk rap music later)
7. This is the Goal
8. NBD ... OMG
10. So What Does Any Good Engineer Do? Go Build by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
11. Three Go Packages: log The go log (https://golang.org/pkg/log/) package is pretty self explanatory Package that enables logging Needed a spectacular failure at the sign of trouble log has three helper functions: print, fatal, and panic Output from the package goes to stderr Used a fatal error to get the web server to stop and log any issue Hugging Gophers by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
12. Three Go Packages: crypto/tls The Go crypto/tls (https://golang.org/pkg/crypto/tls/) package partially implements TLS 1.2, as speci ed in RFC 5246 (https://tools.ietf.org/html/rfc5246) Package con gures usable SSL/TLS versions Identi es preferred cipher suites and elliptic curves used during handshakes This is the package that handles connections securely Gopher Star Wars by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
13. Three Go Packages: net/http Go implementation of HTTP net/http (https://golang.org/pkg/net/http/) has a function called ListenAndServeTLS ListenAndServeTLS provides the desired certi cate checking functionality "If the certi cate is signed by a certi cate authority, the certFile should be the concatenation of the server's certi cate, any intermediates, and the CA's certi cate." Gopher Inclusion by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
14. main: mux, cfg, srv Code creates a mux, short for HTTP request multiplexer I ❤ multiplexers (it's a long story that involves analog signals) mux has a function that creates an HTTP server with headers and content (Hello World!) cfg brings in all the TLS bits seen in a solid web server con g srv puts the pieces together and de nes what port to listen on Gopher Share by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
15. Fail Spectacularly I ❤ DevOps I embrace failure log.Fatal(srv.ListenAndServeTLS("/etc/ssl-tester/tls.crt", "/etc/ssl- tester/tls.key")) De nes path of certi cate les to use Also logs a fatal error if certi cate is not valid Fails Fast
16. It's Open Source! https://github.com/chris-short/ssl-tester (https://github.com/chris-short/ssl-tester)
17. It Works!
18. No. It Really Works!
19. Conclusion The Go code does exactly what I need it to do and nothing more About 40 lines of code!!! I ❤ Go! Binary is a self contained web server Less than 6MB!!! I ❤ Go! Can be safely deployed to any public server External testing run against it for extra vetting Gopher Mic Drop by Ashley McNamara (https://github.com/ashleymcnamara/gophers)
20. Thank you Chris Short Manager of DevOps at Bankrate chris@chrisshort.net (mailto:chris@chrisshort.net) https://devopsish.com (https://devopsish.com) @ChrisShort (http://twitter.com/ChrisShort)