Secure HTTPS servers in Go
By: Uday Hiwarale
Tags: Go Programming Language, Golang, Golang Tutorial, Go Programming, Go

Server.ListenAndServeTLS method

From the earlier lesson, we learned a great deal about Server structure provided by the http module. When we use http.<methodName> methods, we are using Go’s standard HTTP server configuration which is fine in general uses cases but most of the time, we need complete control over our servers.

The Server type lets us create an HTTP server instance with custom configuration. You can read more about this type from this article under the “Server type” lesson. A Server instance has similar methods exported by http package like ListenAndServe , ListenAndServeTLS , etc.

Server struct {

Addr string // TCP address to listen on

Handler typestruct {Addr string // TCP address to listen onHandler Handler // http.DefaultServeMux if `nil`

TLSConfig *Config

} // TLS configuration for HTTPS protocolTLSConfig * tls

This is a minimum required configuration of the Server structure for the HTTPS server. We are familiar with the Addr and Handler fields but let’s TLSConfig is an unexplored territory.

Let’s create an instance of Server but without TLSConfig property set. This is an optional field with the default value of nil . We will dive into that later.

In the example above, we have created a new server s with Addr property set to :9000 and Handler set to nil , just like before. This eliminates the need for providing these values again in s.ListenAndServeTLS() method call.

When you run this program using go run server.go command, it will start an HTTPS server just like before. Only this time, we are no longer bound to Go’s standard server implementation and we can go nuts with it.

TLSConfig field

The TLSConfig field of the Server structure has the *tls.Config type. The Config structure provided by the crypto/tls package configures the TLS parameters of the Server like server certificates among others.

All fields of the Config structure are optional. Hence assigning an empty struct value to TLSConfig field won’t be any different than assigning a nil value just like before. However, the Certificates field can be very useful.

Config struct {

Certificates []

} typestruct {Certificates [] Certificate

The Certificates field of the Config structure sets a list of private key and SSL certificate pairs to use when a client connects to the server. Depending on the client’s TLS handshake, a suitable pair is chosen automatically by Go.

This field is a list (slice data type) of Certificate type. The Certificate is a complex structure type on its own and you can read about it from here but we are going to use tls.LoadX509KeyPair function instead.

LoadX509KeyPair(certFile, keyFile string) ( func(certFile, keyFile string) ( Certificate , error )

This function takes the path to the X.509 SSL certificate file as well as the path of the private key and returns a Certificate struct. Let’s create a Server struct that uses TLSConfig field value.

In the above program, we have created a cert object of type Certificate by using the LoadX509KeyPair function with the certificate and private files we created earlier. It also returns an error, so handle it carefully.

In contract with the earlier example, now we are setting the TLSConfig field of the s struct with a slice that has only cert value.

Since we are pre-configuring Server instance s with a TLS configuration, we do not need to provide certFile and keyFile argument values to the s.ListenAndServeTLS function call anymore.

When you run this server, it will work just like before. But this time, we have abstracted all the configuration of the server from the invoker.