title: Golang ListenAndServeTLS returns data when not using https in the browser
body: <p>The following is my tls backend:</p>
  
  <pre><code>package main
  
  import (
      "fmt"
      "net/http"
  )
  
  const (
      PORT       = ":8443"
      PRIV_KEY   = "./private_key"
      PUBLIC_KEY = "./public_key"
  )
  
  func rootHander(w http.ResponseWriter, r *http.Request) {
      fmt.Fprint(w, "Nobody should read this.")
  }
  
  func main() {
      http.HandleFunc("/", rootHander)
      err := http.ListenAndServeTLS(PORT, PUBLIC_KEY, PRIV_KEY, nil)
      if err != nil {
          fmt.Printf("main(): %s\n", err)
      }
  }
  </code></pre>
  
  <p>The keys are generated using these two lines:</p>
  
  <pre><code>openssl genrsa -out private_key 2048
  openssl req -new -x509 -key private_key -out public_key -days 365
  </code></pre>
  
  <p>When I start the tls server, and visit the site with a browser (<a href="https://example.com:8443" rel="noreferrer">https://example.com:8443</a>) I get the expected result, <em>after</em> ignoring the browser warning:</p>
  
  <pre><code>Nobody should read this.
  </code></pre>
  
  <p>So far everything is cool.</p>
  
  <p>Now, when I point my browser to <a href="http://example.com:8443" rel="noreferrer">http://example.com:8443</a> (notice that http is used, <em>not</em> https) I get the following result for Firfox (Chrome does the same, but downloading the site):</p>
  
  <p><img src="https://i.stack.imgur.com/4KeoW.png" alt="using http"></p>
  
  <p><strong>Question</strong>: Why is there a question mark?</p>