package mtls

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"io"
	"net/http"
	"os"
)

func addTrust(pool *x509.CertPool, path string) {
	aCrt, err := os.ReadFile(path)
	if err != nil {
		fmt.Println("ReadFile err:", err)
		return
	}
	pool.AppendCertsFromPEM(aCrt)
}

func TwoWaySSlCheck() {
	pool := x509.NewCertPool()
	// 这里加载服务端提供的证书，用于校验服务端返回的数据
	addTrust(pool, "../sslFile/server.crt")
	// 这里加载客户端自己的证书，要与提供给服务端的证书一致，不然服务端校验会不通过
	cliCrt, err := tls.LoadX509KeyPair("../sslFile/ville.crt", "../sslFile/ville.key")
	if err != nil {
		fmt.Println("LoadX509KeyPair err:", err)
		return
	}
	tr := &http.Transport{
		TLSClientConfig: &tls.Config{
			RootCAs:      pool,
			Certificates: []tls.Certificate{cliCrt},
		},
	}
	client := &http.Client{Transport: tr}
	resp, err := client.Get("https://localhost:8080")
	if err != nil {
		fmt.Println("Get error:", err)
		return
	}
	defer resp.Body.Close()
	body, err := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

func main() {
	TwoWaySSlCheck()
}