package mtls

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"io"
	"log"
	"net/http"
	"os"
)

type httpsHandler struct {
}

func addTrust(pool *x509.CertPool, path string) {
	aCrt, err := os.ReadFile(path)
	if err != nil {
		fmt.Println("ReadFile err:", err)
		return
	}
	pool.AppendCertsFromPEM(aCrt)

}

func (*httpsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	io.WriteString(w, "golang https server!!!")
}

func main() {
	pool := x509.NewCertPool()

	// 这里是加载客户端提供的证书，最好是加载客户端提供的根证书
	addTrust(pool, "../sslFile/ca.crt")
	addTrust(pool, "../sslFile/ville.crt")

	s := &http.Server{
		Addr:    ":8080",
		Handler: &httpsHandler{},
		TLSConfig: &tls.Config{
			ClientCAs:  pool,
			ClientAuth: tls.RequireAndVerifyClientCert,
		},
	}
	// 这里是加载 服务端自己的证书和私钥
	if err := s.ListenAndServeTLS("../sslFile/server.crt", "../sslFile/server.key"); err != nil {
		log.Fatal("ListenAndServeTLS err:", err)
	}
}