35. TLS in Go: crypto/tls, mutual TLS

35.1 A TLS server with net/http

srv := &http.Server{Addr: ":8443", Handler: mux}
log.Fatal(srv.ListenAndServeTLS("cert.pem", "key.pem"))

35.2 A TLS client that pins expectations explicitly

transport := &http.Transport{
	TLSClientConfig: &tls.Config{
		MinVersion: tls.VersionTLS12,
		// InsecureSkipVerify: true  <-- NEVER in production; disables all
		// hostname/chain verification and defeats the point of TLS.
	},
}
client := &http.Client{Transport: transport, Timeout: 5 * time.Second}

35.3 Generating a local development certificate

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \
  -days 365 -nodes -subj "/CN=localhost"

Chapter 50 builds full mutual TLS (client certificates, not just server certificates) for a real auth use case.

Applied in the series: tlsinspect diagnoses certificate failures, certreload rotates certificates with GetCertificate, and certcheck audits a certificate inventory.