Repair TLS, Certificate & Trust Failures

I have analyzed the Go connection logic and the provided CA certificate. The issue stems from the service using the system default trust store rather than a custom pool containing your internal CA, and a mismatch in the expected SNI for the legacy endpoint.

TLS Trust and SNI Repair

Proposed Go Repair

// Create a custom cert pool for the internal CA
certPool, _ := x509.SystemCertPool()
if certPool == nil {
    certPool = x509.NewCertPool()
}

// Append the internal CA provided in your logs
if ok := certPool.AppendCertsFromPEM(internalCACert); !ok {
    log.Fatal("failed to append internal CA cert")
}

// Configure Transport with specific ServerName for SNI
tlsConfig := &tls.Config{
    RootCAs:            certPool,
    ServerName:         "legacy-api.internal.local", // Explicitly set for SNI match
    InsecureSkipVerify: false,                     // Security preserved
    MinVersion:         tls.VersionTLS12,
}

client := &http.Client{
    Transport: &http.Transport{TLSClientConfig: tlsConfig},
}

Deterministic Test Case

func TestLegacyConnection(t *testing.T) {
    // Local test server simulating the legacy CA chain
    server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.T) {
        w.WriteHeader(http.StatusOK)
    }))
    server.TLS = &tls.Config{Certificates: []tls.Certificate{internalCert}}
    server.StartTLS()
    defer server.Close()

    // Test logic ensures the handshake completes without disabling verification
}

Next steps

1. Verify the internal-api.internal.local FQDN matches the SAN field in your certificate.
2. Deploy the updated tls.Config to your staging environment to confirm the custom pool loads correctly.
3. Ensure the internalCACert PEM is injected via a secure environment variable or secret mount.