TLS

GoNetSim can run HTTPS (and any TLS-wrapped custom listener) using either:

• A user-provided certificate/key (configured in https.cert/https.key), or
• An auto-generated certificate/key.

Auto-generated TLS

When https.cert/https.key are not set, GoNetSim will use a persisted, auto-generated keypair stored next to the active config.toml.

The following files are created in the same directory as config.toml if they don’t already exist:

• gonetsim-cert.pem: server certificate PEM
• gonetsim-key.pem: server private key PEM
• gonetsim-ca.pem: CA certificate PEM

On subsequent starts, if gonetsim-cert.pem and gonetsim-key.pem exist, GoNetSim reuses them. This keeps the server certificate stable across restarts, and is useful for malware which pin certificates.

Trusting the CA certificate

To avoid TLS warnings in tools/browsers, install the CA certificate (gonetsim-ca.pem) into your analysis VM.

Linux / MacOS

1. Copy gonetsim-ca.pem to your local user’s CA certificates directory

   sudo cp ~/.config/gonetsim/gonetsim-ca.pem /usr/local/share/ca-certificates/gonetsim-ca.crt

2. Update the CA certificates

   sudo update-ca-certificates

Windows

1. Open certmgr.msc

2. Import gonetsim-ca.pem into Trusted Root Certification Authorities (Local Computer or Current User, depending on your tooling)

Regenerating the auto-generated certificates

Automatic

1. Run the tls --force command

   gonetsim tls --force

Manual

1. Delete the persisted files next to config.toml

   • gonetsim-cert.pem
   • gonetsim-key.pem
   • gonetsim-ca.pem

2. Restart GoNetSim

Validating TLS

You can verify the TLS certificates with the tls --verify-only flag

gonetsim tls --verify-only

Further reading

• See the basic configuration guide for a walkthrough on configuration
• See the HTTPS reference for HTTPS-specific TLS options
• See the listeners reference for TLS options on custom listeners