{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/12910","labels_url":"https://api.github.com/repos/golang/go/issues/12910/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/12910/comments","events_url":"https://api.github.com/repos/golang/go/issues/12910/events","html_url":"https://github.com/golang/go/issues/12910","id":111009620,"number":12910,"title":"encoding/asn1: failed to parse certificate from server: asn1: syntax error: sequence truncated","user":{"login":"dg-ratiodata","id":1267524,"avatar_url":"https://avatars.githubusercontent.com/u/1267524?v=3","gravatar_id":"","url":"https://api.github.com/users/dg-ratiodata","html_url":"https://github.com/dg-ratiodata","followers_url":"https://api.github.com/users/dg-ratiodata/followers","following_url":"https://api.github.com/users/dg-ratiodata/following{/other_user}","gists_url":"https://api.github.com/users/dg-ratiodata/gists{/gist_id}","starred_url":"https://api.github.com/users/dg-ratiodata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dg-ratiodata/subscriptions","organizations_url":"https://api.github.com/users/dg-ratiodata/orgs","repos_url":"https://api.github.com/users/dg-ratiodata/repos","events_url":"https://api.github.com/users/dg-ratiodata/events{/privacy}","received_events_url":"https://api.github.com/users/dg-ratiodata/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/24","html_url":"https://github.com/golang/go/milestones/Go1.6","labels_url":"https://api.github.com/repos/golang/go/milestones/24/labels","id":1096159,"number":24,"title":"Go1.6","description":"","creator":{"login":"josharian","id":67496,"avatar_url":"https://avatars.githubusercontent.com/u/67496?v=3","gravatar_id":"","url":"https://api.github.com/users/josharian","html_url":"https://github.com/josharian","followers_url":"https://api.github.com/users/josharian/followers","following_url":"https://api.github.com/users/josharian/following{/other_user}","gists_url":"https://api.github.com/users/josharian/gists{/gist_id}","starred_url":"https://api.github.com/users/josharian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josharian/subscriptions","organizations_url":"https://api.github.com/users/josharian/orgs","repos_url":"https://api.github.com/users/josharian/repos","events_url":"https://api.github.com/users/josharian/events{/privacy}","received_events_url":"https://api.github.com/users/josharian/received_events","type":"User","site_admin":false},"open_issues":127,"closed_issues":419,"state":"open","created_at":"2015-05-05T02:39:06Z","updated_at":"2015-12-09T06:36:13Z","due_on":"2016-01-31T08:00:00Z","closed_at":null},"comments":18,"created_at":"2015-10-12T16:25:56Z","updated_at":"2015-12-09T11:05:26Z","closed_at":null,"body":"### Issue\r\n\r\nI use two projects which are built with go: [`docker`](https://github.com/docker/docker) and [`gitlab-ci-runner`](https://gitlab.com/gitlab/gitlab-ci-runner).\r\n\r\nBoth products try to connect to an HTTPS-enabled webservice and fail. In one case it's the docker daemon in the other case it's a NGINX in front of [gitlab](https://gitlab.com/gitlab/gitlab). In both cases I get similar errors:\r\n\r\n~~~\r\n: tls: failed to parse certificate from server: asn1: syntax error: sequence truncated\r\n~~~\r\n\r\n### Setup\r\n\r\nBoth webservices use a (different) certificate issued by an internal Sub-CA:\r\n\r\n~~~\r\nRoot-CA\r\n  Sub-CA\r\n     Sub-CA\r\n       Sub-CA\r\n         Server-CRT\r\n~~~\r\n\r\nI tried the webservices to serve the full chain excluding the Root-CA. \r\n\r\n* Gitlab:\r\n  \r\n  Accessing `gitlab` with Firefox, Chromium, `curl` and `openssl s_client` works fine since I setup `ca-trust` correctly: The root CA certificate is stored at `/etc/(pki|ca-certificates/trust-source/anchor` + `sudo update-ca-trust`.\r\n\r\n* `docker`\r\n  \r\n  This only worked if I added a single CA to the server CRT. This would require to distribute the other Root-/Sub-CAs on quite a few machines where the docker client runs.\r\n\r\n### Expected behaviour\r\n\r\nI expect both programs to support certificate chains including verification.\r\n\r\n### My role\r\n\r\nFrom your perspective I'm a end-user of both products and NOT an developer/maintiner of those products.\r\n\r\n### Information about software products\r\n\r\n#### docker\r\n\r\n~~~\r\nClient:\r\nVersion:      1.8.1\r\nAPI version:  1.20\r\nGo version:   go1.4.2\r\nGit commit:   d12ea79\r\nBuilt:        Thu Aug 13 02:19:43 UTC 2015\r\nOS/Arch:      linux/amd64\r\n\r\nServer:\r\nVersion:      1.8.1\r\nAPI version:  1.20\r\nGo version:   go1.4.2\r\nGit commit:   d12ea79\r\nBuilt:        Thu Aug 13 02:19:43 UTC 2015\r\nOS/Arch:      linux/amd64\r\n~~~\r\n\r\n#### gitlab-ci-runner\r\n\r\nI'm not sure, what `go`-version exactly was used to create the executable, but they use the docker image \"golang:1.4\" from the docker library.\r\n\r\n### Related issues\r\n\r\n* https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/issues/222\r\n* https://github.com/docker/docker/issues/16448\r\n\r\nI opened an issue for the HTTPS-problem at golang as well @ayufan @cpuguy83 \r\n"},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/163189881","html_url":"https://github.com/golang/go/issues/12910#issuecomment-163189881","issue_url":"https://api.github.com/repos/golang/go/issues/12910","id":163189881,"user":{"login":"dg-ratiodata","id":1267524,"avatar_url":"https://avatars.githubusercontent.com/u/1267524?v=3","gravatar_id":"","url":"https://api.github.com/users/dg-ratiodata","html_url":"https://github.com/dg-ratiodata","followers_url":"https://api.github.com/users/dg-ratiodata/followers","following_url":"https://api.github.com/users/dg-ratiodata/following{/other_user}","gists_url":"https://api.github.com/users/dg-ratiodata/gists{/gist_id}","starred_url":"https://api.github.com/users/dg-ratiodata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dg-ratiodata/subscriptions","organizations_url":"https://api.github.com/users/dg-ratiodata/orgs","repos_url":"https://api.github.com/users/dg-ratiodata/repos","events_url":"https://api.github.com/users/dg-ratiodata/events{/privacy}","received_events_url":"https://api.github.com/users/dg-ratiodata/received_events","type":"User","site_admin":false},"created_at":"2015-12-09T11:05:26Z","updated_at":"2015-12-09T11:05:26Z","body":"@rsc Wow, that was quick. Thanks for fixing this issue."}}