Golang : Use TLS version 1.2 and enforce server security configuration over client

Problem:

You want to force your Golang program to use TLS(Transport Layer Security) protocol version 1.2 only and use server TLS configuration instead of client. How to do that?

Solution:

Set the MinVersion, MaxVersion parameters to tls.VersionTLS12 and PreferServerCipherSuites to true. Setting PreferServerCipherSuites will force client to use server TLS configuration.

 config.MinVersion = tls.VersionTLS12 
 config.MaxVersion = tls.VersionTLS12
 config.PreferServerCipherSuites = true

For example:

 config := tls.Config{Certificates : []tls.Certificate{certificate}, ClientAuth: tls.RequireAnyClientCert}

 config.CipherSuites = []uint16{
 tls.TLS_RSA_WITH_AES_256_CBC_SHA,
 tls.TLS_RSA_WITH_AES_128_CBC_SHA,
 tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
 tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
 tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
 tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
 tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}

 config.MinVersion = tls.VersionTLS12 
 config.MaxVersion = tls.VersionTLS12
 config.PreferServerCipherSuites = true

References:

https://golang.org/pkg/crypto/tls/#pkg-constants

http://stackoverflow.com/questions/21562269/golang-how-to-specify-certificate-in-tls-config-for-http-client