Tomato 下面运行需要 SSL/TLS 连接的 Golang 程序（多为静态编译），可能会出现类似：
x509: certificate signed by unknown authority
这样的证书相关问题，目前遇到过的有 overture 以及 dnscrypt-proxy，这里有讨论。
主要就是 x509 默认只在以下目录搜索证书：
"/etc/ssl/certs", // SLES10/SLES11, https://golang.org/issue/12139
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs", // FreeBSD
"/etc/pki/tls/certs", // Fedora/RHEL
"/etc/openssl/certs", // NetBSD
或者这几个文件：（https://mirrors.segmentfault.com/golang/root_linux.go）
// Possible certificate files; stop after finding one.
var certFiles = []string{
"/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem", // OpenSUSE
"/etc/pki/tls/cacert.pem", // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
}
而 Entware 默认是安装在 /opt/etc/ssl 目录下；
查看 Golang 源码提示可以设置环境变量：
https://golang.org/src/crypto/x509/root_unix.go
const (
// certFileEnv is the environment variable which identifies where to locate
// the SSL certificate file. If set this overrides the system default.
certFileEnv = "SSL_CERT_FILE"
// certDirEnv is the environment variable which identifies which directory
// to check for SSL certificate files. If set this overrides the system default.
certDirEnv = "SSL_CERT_DIR"
)
解决办法：
1. 通过 Entware 安装 ca 证书：
opkg update
opkg upgrade
opkg install ca-bundle
opkg install ca-certificates
2. 在 /opt/etc/.profile 中设置环境变量：
# SSL for Golang
export SSL_CERT_FILE=/opt/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_DIR=/opt/etc/ssl/certs
这样就没问题了。
