title: Failed to connect to a server with Golang due x509 certificate relies on legacy Common Name field
body: <p>I'm trying to connect on a mongodb server, to connect I have to provide a CA cert file and also tls cert file.</p>
  <p>When I use the following command I don't have issue</p>
  <pre><code>$ mongo --host customhost:port DB --authenticationDatabase=DB -u ACCOUNT -p PWD --tls --tlsCAFile /etc/ca-files/new-mongo.ca.crt --tlsCertificateKeyFile /etc/ca-files/new-mongo-client.pem 
  </code></pre>
  <p>But when I try to connect with mongo (and also tested with just a tls client) I have the following error:</p>
  <pre><code>failed to connect: x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
  </code></pre>
  <p>If I use the env variable everything works well but I would like to know how to fix it without having to use it.</p>
  <pre class="lang-golang prettyprint-override"><code>const CONFIG_DB_CA = &quot;/etc/ca-files/new-mongo.ca.crt&quot;
  
  func main() {
      cer, err := tls.LoadX509KeyPair(&quot;mongo-server.crt&quot;, &quot;mongo-server.key&quot;)
      if err != nil {
          log.Println(err)
          return
      }
  
      roots := x509.NewCertPool()
      ca, err := ioutil.ReadFile(CONFIG_DB_CA)
      if err != nil {
          fmt.Printf(&quot;Failed to read or open CA File: %s.\n&quot;, CONFIG_DB_CA)
          return
      }
      roots.AppendCertsFromPEM(ca)
  
      tlsConfig := &amp;tls.Config{
          Certificates: []tls.Certificate{cer},
          RootCAs:      roots,
      }
  
      conn, err := tls.Dial(&quot;tcp&quot;, &quot;customhost:port&quot;, tlsConfig)
      if err != nil {
          fmt.Printf(&quot;failed to connect: %v.\n&quot;, err)
          return
      }
  
      err = conn.VerifyHostname(&quot;customhost&quot;)
      if err != nil {
          panic(&quot;Hostname doesn't match with certificate: &quot; + err.Error())
      }
      for i, cert := range conn.ConnectionState().PeerCertificates {
          prefix := fmt.Sprintf(&quot;CERT%d::&quot;, i+1)
          fmt.Printf(&quot;%sIssuer: %s\n&quot;, prefix, cert.Issuer)
          fmt.Printf(&quot;%sExpiry: %v\n&quot;, prefix, cert.NotAfter.Format(time.RFC850))
          fmt.Printf(&quot;%sDNSNames: %v\n\n&quot;, prefix, cert.DNSNames)
      }
      
      fmt.Printf(&quot;Success!&quot;)
  }
  
  </code></pre>
  <p>Certificates:</p>
  <pre class="lang-sh prettyprint-override"><code>$ openssl x509 -in /etc/ca-files/new-mongo.ca.crt -text -noout
  Certificate:
      Data:
          Version: 3 (0x2)
          Serial Number:
              ....
          Signature Algorithm: sha256WithRSAEncryption
          Issuer: C = FR, ST = IDF, L = Paris, O = COMP, OU = IT, CN = newmongo
          Validity
              Not Before: Jun 30 13:02:12 2021 GMT
              Not After : Jun 30 13:02:12 2023 GMT
          Subject: C = FR, ST = IDF, L = Paris, O = COMP, OU = IT, CN = newmongo
  
  ...
  
          X509v3 extensions:
              X509v3 Subject Key Identifier: 
                  ...
              X509v3 Authority Key Identifier: 
                  ....
  
              X509v3 Basic Constraints: critical
                  CA:TRUE
  </code></pre>
  <pre class="lang-sh prettyprint-override"><code>$ openssl x509 -in /etc/ca-files/newmongo-client.pem -text -noout 
  Certificate:
      Data:
          Version: 3 (0x2)
          Serial Number:
              ...
          Signature Algorithm: sha256WithRSAEncryption
          Issuer: C = FR, ST = IDF, L = Paris, O = COMP, OU = IT, CN = newmongo
          Validity
              Not Before: Jun 30 13:17:25 2021 GMT
              Not After : Jun 30 13:17:25 2023 GMT
          Subject: C = FR, ST = IDF, L = Paris, O = COMP, OU = IT, CN = newmongo-client
  ...
          X509v3 extensions:
              X509v3 Subject Alternative Name: 
                  DNS:customhost:port, DNS:customhost, DNS:newmongo-client
  </code></pre>
  <p>I'm a bit stuck and don't know if the problem is my code configuration of tls and the way I loaded certificates or if it comes from the SSL certificate misconfiguration but from what certificates look fine.
  I feel like loaded certificate are ignored for any reason</p>
  <p>Thanks for your help</p>