How do you set TLS options for outbound HTTPS calls from a Go http.Client?

## The client has no TLS knobs `http.Client` is a policy object: it holds a `Transport`, a timeout, a redirect policy and a cookie jar. It has no TLS fields whatsoever. Everything about the TLS handshake on the outbound side belongs to `http.Transport`, whose `TLSClientConfig *tls.Config` is consulted whenever the transport dials a new HTTPS connection. ```go tr := http.DefaultTransport.(*http.Transport).Clone() tr.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS13} client := &http.Client{Transport: tr} // build once, reuse everywhere ``` That is the whole mechanism. The interesting parts are the three mistakes around it. ## Mistake one: editing the default transport `http.DefaultTransport` is a single package-level value shared by `http.DefaultClient` and by every library in the process that did not bring its own. Assigning to its `TLSClientConfig` changes TLS for code you have never read — a metrics reporter, a health checker, some SDK. It is also a data race if anything is already using it. Clone it and edit the clone; the clone starts from the same sensible dialer and pool settings, which is why it is preferable to constructing a transport from scratch. ## Mistake two: a hand-built transport quietly loses HTTP/2 `http.Transport` upgrades itself to HTTP/2 automatically only when you have not customised the dialing or TLS path. Once you set `TLSClientConfig` (or a custom `DialContext`), the automatic upgrade is off unless `ForceAttemptHTTP2` is true. `http.DefaultTransport` already has that field set, so a clone keeps HTTP/2; `&http.Transport{TLSClientConfig: cfg}` does not, and the symptom is a mysterious protocol downgrade weeks later with no error anywhere. This is the strongest single argument for the clone idiom. ## Mistake three: a client per request A transport is a connection pool. Constructing one per request means a fresh TCP connection and a fresh TLS handshake every time, with the old ones lingering until they idle out. Build the client once at startup, hand it to whatever needs it, and let the pool do its job. ## Changing the config later does not re-handshake If you mutate `TLSClientConfig` after the transport has already dialed, connections already sitting in the pool are unaffected — they were negotiated under the old settings and will be reused as they are. Only newly dialed connections see the change. Worse, editing a `*tls.Config` that live connections are reading is a data race; `tls.Config` has a `Clone` method precisely so you can build a modified copy instead. In practice, decide the TLS config at startup and treat it as frozen. ## Dialing TLS without HTTP Not every outbound TLS connection is an HTTP request. For a line protocol, a health probe, or anything speaking its own bytes over TLS, `crypto/tls` dials directly: ```go conn, err := tls.Dial("tcp", "payments.internal:8443", &tls.Config{MinVersion: tls.VersionTLS12}) if err != nil { return err } defer conn.Close() ``` `tls.Dial` returns a `*tls.Conn`, which is a `net.Conn` you can read and write normally, plus a `ConnectionState()` method reporting what the handshake actually agreed. When you need cancellation, `tls.Dialer{NetDialer: &net.Dialer{}, Config: cfg}` provides `DialContext`, which is the same thing with a `context.Context`. One convenience worth knowing: if the config's `ServerName` is empty, `tls.Dial` fills it in from the address you dialed, which is what makes the plain three-argument call work at all. ## Applying a policy consistently Because the setting lives on a transport rather than on the language, an outbound TLS policy is only as good as the number of places that construct clients. The workable pattern in a codebase of any size is one constructor — `func newHTTPClient() *http.Client` — that clones the default transport, applies the config, and is the only sanctioned way to get a client. Then the policy is one function to review and one function to change, and a code search for `&http.Client{` finds the exceptions.