go.go

package main

import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
	"log"
	"net/http"

	cleanhttp "github.com/hashicorp/go-cleanhttp"
)

func main() {
	t := cleanhttp.DefaultTransport()
	certs, err := ioutil.ReadFile("acme-staging.pem")
	if err != nil {
		log.Fatal(err)
	}
	t.TLSClientConfig = &tls.Config{RootCAs: x509.NewCertPool()}
	t.TLSClientConfig.RootCAs.AppendCertsFromPEM(certs)
	c := &http.Client{Transport: t}
	resp, err := c.Get("https://galaxy.test-20160721224638.meet-eeyore.com/")
	log.Print(err)
	log.Print(resp)
}

node.js

var https = require('https');
var fs = require('fs');

https.get({
  hostname: 'galaxy.test-20160721224638.meet-eeyore.com',
  path: '/',
  ca: fs.readFileSync('acme-staging.pem')
}, function (res) {
  console.log("got response", res.statusCode);
}).on('error', function (e) {
  console.log("got error", e.message);
});

Hi. Did you notice this in the documentation?

The following options from tls.connect() can also be specified. However, a globalAgent silently ignores these.
[...]
In order to specify these options, use a custom Agent.
[example code]
Alternatively, opt out of connection pooling by not using an Agent.
[example code]