go 原生代码搞定https双向认证客户端私钥加密

import (
    "crypto/tls"
    "crypto/x509"
    "encoding/pem"
    "io/ioutil"
    "net/http"
)

func InitHttpsClient(keyPem, certPem, pemPass string) *http.Client {
    // 读取私钥文件
    keyBytes, err := ioutil.ReadFile(keyPem)
    if err != nil {
        panic("Unable to read keyPem")
    }
    // 把字节流转成PEM结构
    block, rest := pem.Decode(keyBytes)
    if len(rest) > 0 {
        panic("Unable to decode keyBytes")
    }
    // 解密PEM
    der, err := x509.DecryptPEMBlock(block, []byte(pemPass))
    if err != nil {
        panic("Unable to decrypt pem block")
    }
    // 解析出其中的RSA 私钥
    key, err := x509.ParsePKCS1PrivateKey(der)
    if err != nil {
        panic("Unable to parse pem block")
    }
    // 编码成新的PEM 结构
    keyPEMBlock := pem.EncodeToMemory(
        &pem.Block{
            Type:  "RSA PRIVATE KEY",
            Bytes: x509.MarshalPKCS1PrivateKey(key),
        },
    )
    // 读取证书文件
    certPEMBlock, err := ioutil.ReadFile(certPem)
    if err != nil {
        panic("Unable to read certPem")
    }
    // 生成密钥对
    cert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
    if err != nil {
        panic("Unable to read privateKey")
    }

    client := &http.Client{
        Transport: &http.Transport{
            TLSClientConfig: &tls.Config{
                Certificates:       []tls.Certificate{cert},
                InsecureSkipVerify: true,
            },
        },
    }
    return client
}