Is there a way to use the TLS for authenticating a browser?
The Software I develop provides a web interface and I want to limit the access only to a trusted clients (browsers). By “trusted” I mean such that have a proper “certificate” file installed manually.
In other words, I was wondering if there is a way to generate some special cert+key files (for the http.ListenAndServeTLS function), together with an additional “secret” file to be imported into a client browser certificate storage.
All to make sure that only the browsers that have imported this “secret” file can access the web interface.
I don’t care about trusting the server - only about trusting the client.
When I first saw your question I was plagued by a slough of thoughts about what is and isn’t appropriate for authentication, and so I dived into why one might do this. I found some good answers as to why you would use it and here is some help with getting the server to require a certificate: https://stackoverflow.com/questions/24181081/request-client-certificate-for-authentication
For more detailed information on what settings are available with regards to tls in Go’s standard library, refer to this: https://godoc.org/crypto/tls#Config
Thanks for your question, gave me the opportunity to learn something I wouldn’t have thought to do.