Tomato 下面运行需要 SSL/TLS 连接的 Golang 程序（多为静态编译），可能会出现类似：

x509: certificate signed by unknown authority

这样的证书相关问题，目前遇到过的有 overture 以及 dnscrypt-proxy，这里有讨论。

主要就是 x509 默认只在以下目录搜索证书：

"/etc/ssl/certs", // SLES10/SLES11, https://golang.org/issue/12139
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs", // FreeBSD
"/etc/pki/tls/certs", // Fedora/RHEL
"/etc/openssl/certs", // NetBSD

或者这几个文件：（https://mirrors.segmentfault.com/golang/root_linux.go）


// Possible certificate files; stop after finding one.
var certFiles = []string{
"/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem", // OpenSUSE
"/etc/pki/tls/cacert.pem", // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
}

而 Entware 默认是安装在 /opt/etc/ssl 目录下；

查看 Golang 源码提示可以设置环境变量：

https://golang.org/src/crypto/x509/root_unix.go

const (
// certFileEnv is the environment variable which identifies where to locate
// the SSL certificate file. If set this overrides the system default.
certFileEnv = "SSL_CERT_FILE"
// certDirEnv is the environment variable which identifies which directory
// to check for SSL certificate files. If set this overrides the system default.
certDirEnv = "SSL_CERT_DIR"
)

解决办法：

1. 通过 Entware 安装 ca 证书：

opkg update
opkg upgrade
opkg install ca-bundle
opkg install ca-certificates

2. 在 /opt/etc/.profile 中设置环境变量：

# SSL for Golang
export SSL_CERT_FILE=/opt/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_DIR=/opt/etc/ssl/certs

这样就没问题了。