I'm creating a Go TCP server (NOT http/s) and I'm trying to configure it to use SSL. I have a StartCom free SSL certificate which I am trying to use to accomplish this. My server code looks like this:

    cert, err := tls.LoadX509KeyPair("example.com.pem", "example.com.key")
    if err != nil {
        fmt.Println("Error loading certificate. ",err)
    }
    trustCert, err := ioutil.ReadFile("sub.class1.server.ca.pem")
    if err != nil {
        fmt.Println("Error loading trust certificate. ",err)
    }
    validationCert, err := ioutil.ReadFile("ca.pem")
    if err != nil {
        fmt.Println("Error loading validation certificate. ",err)
    }
    certs := x509.NewCertPool()
    if !certs.AppendCertsFromPEM(validationCert) {
        fmt.Println("Error installing validation certificate.")
    }
    if !certs.AppendCertsFromPEM(trustCert) {
        fmt.Println("Error installing trust certificate.")
    }

    sslConfig := tls.Config{RootCAs: certs,Certificates: []tls.Certificate{cert}}

    service := ":5555"
    tcpAddr, error := net.ResolveTCPAddr("tcp", service)
    if error != nil {
        fmt.Println("Error: Could not resolve address")
    } else {
        netListen, error := tls.Listen(tcpAddr.Network(), tcpAddr.String(), &sslConfig)
        if error != nil {
            fmt.Println(error)
        } else {
            defer netListen.Close()

            for {
                fmt.Println("Waiting for clients")
                connection, error := netListen.Accept()
openssl s_client -CApath /etc/ssl/certs/ -connect localhost:5555verify error:num=20:unable to get local issuer certificate