How does the client verify the server's authenticity (certificates)?

The client verifies the server's authenticity by checking the TLS certificate provided by the server during the establishment of a secure connection (e.g., HTTPS). The process includes the following steps:

1. The client receives the server's certificate.
2. It verifies that the certificate is signed by a trusted certification authority (CA) using root certificates stored in the system or application.
3. It checks that the domain name in the certificate matches the server's address.
4. It verifies the certificate's validity period.

In Go, for HTTPS clients, this is done automatically when using the standard net/http and crypto/tls packages. If needed, you can configure tls.Config with the RootCAs parameter to specify trusted CAs or use InsecureSkipVerify (not recommended) to disable verification.

Example of configuring a client with certificate verification:

import (
    "crypto/tls"
    "crypto/x509"
    "io/ioutil"
    "net/http"
)

// Load custom CA
caCert, err := ioutil.ReadFile("ca.pem")
if err != nil {
    // handle error
}
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)

client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            RootCAs: caCertPool,
        },
    },
}

resp, err := client.Get("https://example.com")
// ...

Thus, the client trusts the server if the certificate is valid and signed by a trusted CA.