Repository: go
Issue: x/crypto/acme/autocert: Error http: TLS handshake error from <ip>:<port>: Head "": unsupported protocol scheme "" trying to connect to letsencrypt's pebble
Labels: NeedsInvestigation

<!--
Please answer these questions before submitting your issue. Thanks!
For questions please use one of our forums: https://github.com/golang/go/wiki/Questions
-->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.10.8 linux/amd64
</pre>

### Does this issue reproduce with the latest release?
Yes. It happens with: go version go1.14.3 linux/amd64

### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/tofs/.cache/go-build"
GOENV="/home/tofs/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/tofs/Private/production/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build170790492=/tmp/go-build -gno-record-gcc-switches"

</pre></details>

### What did you do?

* pebble is a lightweight implementation of an ACME server, for e2e testing purposes. It's available here: https://github.com/letsencrypt/pebble
* this is running inside a docker container with wget pre-installed

I added "example.org" to /etc/hosts pointing to the docker container's ip address. 
I moved pebble test certificate to /etc/ssl/certs/ca-certificates.crt
I started pebble with: 
          PEBBLE_VA_ALWAYS_VALID=1 ./pebble -strict  

I started a https server in the same container running this code: 
```go
import (
	"crypto/rsa"
	"golang.org/x/crypto/acme"
	"golang.org/x/crypto/acme/autocert"
	"log"
	"math/rand"
	"net/http"
	"time"
)

func main() {
	key, err := rsa.GenerateKey(rand.New(rand.NewSource(time.Now().UnixNano())), 2048)
	client := &acme.Client{DirectoryURL: "https://localhost:14000/dir", Key: key}
	m := &autocert.Manager{
		Cache:      autocert.DirCache("secret-dir"),
		Prompt:     autocert.AcceptTOS,
		HostPolicy: autocert.HostWhitelist("example.org", "www.example.org"),
		Client:     client,
	}
	if err != nil {
		log.Fatal(err)
	}
	s := &http.Server{
		Addr:      ":https",
		TLSConfig: m.TLSConfig(),
	}
	s.ListenAndServeTLS("", "")
}
```
I issued a call using wget to https://example.org

### What did you expect to see?

A 404 - page not found error

### What did you see instead?

* wget output: 
--2020-05-27 21:30:28--  https://example.org/
Resolving example.org (example.org)... 172.17.0.4
Connecting to example.org (example.org)|172.17.0.4|:443... connected.
GnuTLS: A TLS fatal alert has been received.
GnuTLS: received alert [80]: Internal error
Unable to establish SSL connection.

* https server log (stderr): 
2020/05/27 21:30:28 http: TLS handshake error from 172.17.0.4:53518: Head "": unsupported protocol scheme ""

* pebble output: 
Pebble 2020/05/27 21:30:28 GET /dir -> calling handler()
Pebble 2020/05/27 21:30:28 HEAD /dir -> calling handler()