# Mender Client not authorising when using GO 1.15

**URL:** <https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949>\
**Category:** General Discussions\
**Tags:** mender-server\
**Created:** [December 7, 2020, 7:05pm UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949 "2020-12-07T19:05:51Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@martin](https://hub.mender.io/u/martin)\
**Post date:** [December 7, 2020, 7:05pm UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/1 "2020-12-07T19:05:51Z")

</div>

Hi,

I’m seeing the following error in the Mender Client

```
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Failure occurred while executing authorization request: &url.Error{Op:\"Post\", URL:\"[https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\"](https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\%22), Err:x509.HostnameError{Certificate:(*x509.Certificate)(0x2862dc0), Host:\"rufilla.octopus.mender.com\"}}"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Failure occurred while executing authorization request: &url.Error{Op:\"Post\", URL:\"[https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\"](https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\%22), Err:x509.HostnameError{Certificate:(*x509.Certificate)(0x2862dc0), Host:\"rufilla.octopus.mender.com\"}}"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Authorization request error: x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Authorize failed: transient error: authorization request failed: generic error occurred while executing authorization request: Post \"[https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\":](https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\%22:) x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=info msg="State transition: authorize [Sync] -> authorize-wait [Idle]"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Authorization request error: x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"
Dec 07 18:52:00 dlink-g300-mt7688an mender[362]: time="2020-12-07T18:52:00Z" level=error msg="Authorize failed: transient error: authorization request failed: generic error occurred while executing authorization request: Post \"[https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\":](https://rufilla.octopus.mender.com/api/devices/v1/authentication/auth_requests\%22:) x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0"

```

I’m using Yocto version gatesgarth and the go version is

```
2.3.1-r0$ ./recipe-sysroot-native/usr/bin/go version
go version go1.15.2 linux/amd64

```

And looking on the internet I see that support for CN is dropped in this version of GO.

`https://github.com/golang/go/issues/39568`

Are there plans to update the keygen script to use SAN instead of the CN?

Best Regards,  
Martin.

---

<div class="post-metadata">

**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\
**Post date:** [December 8, 2020, 7:19am UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/2 "2020-12-08T07:19:38Z")

</div>

It does look like we should update the keygen script, and I assume this is only a problem when using self-signed certificates.

Tagging some people who might have additional comments. @eystein @kacf

---

<div class="post-metadata">

**Author:** ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)\
**Post date:** [December 8, 2020, 8:03am UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/3 "2020-12-08T08:03:03Z")

</div>

Pretty much what Mirza said. This will probably come up naturally when we move to the next LTS Yocto branch (I’m not quite clear on whether this is 0.5 or 1.5 years from now), but it would be good to have this fixed before then anyway. Less stuff that can bite us later. Feel free to create a ticket for it.

---

<div class="post-metadata">

**Author:** ![martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@martin](https://hub.mender.io/u/martin)\
**Post date:** [December 8, 2020, 9:28am UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/4 "2020-12-08T09:28:37Z")

</div>

I tried the instructions on letsencrypt

> **[Certificates for localhost - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/docs/certificates-for-localhost/#making-and-trusting-your-own-certificates)**
>
> Last updated: Dec 21, 2017 | See all Documentation Sometimes people want to get a certificate for the hostname “localhost”, either for use in local development, or for distribution with a native application that needs to communicate with...

using this configuration file

```
[dn]
CN=rufilla.octopus.mender.com

[req]
distinguished_name = dn

[EXT]
subjectAltName=DNS:rufilla.octopus.mender.com
keyUsage=digitalSignature
extendedKeyUsage=serverAuth

```

and updating keygen to use it

```
cd api-gateway
openssl req -x509 -sha256 -nodes -days $CERT_VALID_DAYS -newkey ec:<(openssl ecparam -name prime256v1) -ke
yout $FILE_NAME_PRIVATE_KEY -out $FILE_NAME_CERT -subj /CN="$CERT_API_CN" -extensions EXT -config /ws/rufi
lla/octopus/mender-server/ssl.conf
cd ..

cd storage-proxy
openssl req -x509 -sha256 -nodes -days $CERT_VALID_DAYS -newkey ec:<(openssl ecparam -name prime256v1) -ke
yout $FILE_NAME_PRIVATE_KEY -out $FILE_NAME_CERT -subj /CN="$CERT_STORAGE_CN" -extensions EXT -config /ws/
rufilla/octopus/mender-server/ssl.conf
cd ..

```

And it now works 🙂

Probably best to create a temporary file with mktemp to create the configuration file but it will do for now.

---

<div class="post-metadata">

**Author:** ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)\
**Post date:** [December 8, 2020, 8:06pm UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/5 "2020-12-08T20:06:10Z")

</div>

@martin thanks for the report

If you have the chance it would be awesome if you could create a PR against this script with your improvements: [https://github.com/mendersoftware/integration/blob/master/keygen](https://github.com/mendersoftware/integration/blob/master/keygen)

Is a separate file required now to specify what used to be the CN? I suppose we could move it to a subdirectory in that case (and update path in docs), but ideally avoiding manually editing files (rather take parameters to the keygen script).

---

<div class="post-metadata">

**Author:** ![martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@martin](https://hub.mender.io/u/martin)\
**Post date:** [December 9, 2020, 9:49am UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/6 "2020-12-09T09:49:55Z")

</div>

Will do, I’ve updated the keygen script to create temporary config files which it populates and then removes once finished, would this be ok?

---

<div class="post-metadata">

**Author:** ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)\
**Post date:** [December 11, 2020, 11:25pm UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/7 "2020-12-11T23:25:29Z")

</div>

Thank you, perfect!

That sounds great to me, perhaps also do it with mktmp to avoid conflicts. 👍

---

<div class="post-metadata">

**Author:** ![martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@martin](https://hub.mender.io/u/martin)\
**Post date:** [January 6, 2021, 10:55am UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/8 "2021-01-06T10:55:11Z")

</div>

@eystein: How do I raise a PR? I can’t seem to find anything on Github even when logging into my account.

---

<div class="post-metadata">

**Author:** ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)\
**Post date:** [January 6, 2021, 4:31pm UTC](https://hub.mender.io/t/mender-client-not-authorising-when-using-go-1-15/2949/9 "2021-01-06T16:31:23Z")

</div>

@martin we’re using the normal Github fork and PR workflow.

Are you not able to create a fork when logged in here? [https://github.com/mendersoftware/integration](https://github.com/mendersoftware/integration)

Then create a local branch, push to your fork and visit it on github create a PR from there?