TLS with self signed certificate about etcd3 HOT 7 CLOSED

Can you provide the code you're using to load the cert and set up the client?

from etcd3.

const fs = require('fs');
const { Etcd3 } = require('etcd3');

const rootCertificate = fs.readFileSync(`${__dirname}/etcd.pem`);
const client = new Etcd3({
        hosts: 'some.etcd.cluster:2379',
        auth: {
                username: 'developer',
                password: 'developer'
        },
        credentials: {
                rootCertificate
        }
});

console.log('getting...');
client.getAll()
        .prefix('home')
        .strings()
        .then(value => {
                console.log(value);
        });

If I change the hosts prop to a local instance and drop the other props on the options argument since localhost isn't using SSL/TLS, it connects and works as expected.

from etcd3.

I've played around locally and haven't managed to reproduce your issue. From a quick google, 14094410 looks like it could be a wide range of things (yay for specific errors). Some ideas:

1. To confirm, the server is not requiring client cert auth?
2. Are you using a recent OpenSSL version on the client?
3. Try with the newly released [email protected], which pulls in upstream GRPC updates including several changes to TLS/SSL handling
4. Is anything (apache/nginx/haproxy/etc) running in front of etcd?

from etcd3.

1. Correct, not using a client cert for auth.
2. OpenSSL 1.0.2g 1 Mar 2016 System in question is Ubuntu 17.04, this is the version currently installed based on that distro.
3. Will try and report back.
4. No, code is directly accessing the etcd cluster without any proxying.

from etcd3.

@commandline were you able to try the fourth bullet point? Also, grpc continues to be updated, you might give another shot with [email protected] which updates to grpc 1.6.0.

from etcd3.

I've got a similar issue except with as verify failed...

E1002 15:56:08.589165000 140736018240320 ssl_transport_security.c:921] Handshake failed with fatal error SSL_ERROR_SSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed.

This is with the latest 0.2.5/1.6.0 - dumping the pool Authenticator shows things are in place...

Authenticator {
  options: 
   { hosts: 
      [ 'https://sl-us-south-1-portal.4.dblayer.com:23842',
        'https://sl-us-south-1-portal.5.dblayer.com:23842' ],
     auth: { username: 'root', password: 'SEKRITSTUFFS' },
     credentials: { ca: <Buffer 2d 2d 2d 2d 2d 42 45 47 49 4e 20 43 45 52 54 49 46 49 43 41 54 45 2d 2d 2d 2d 2d 0a 4d 49 49 44 66 54 43 43 41 6d 57 67 41 77 49 42 41 67 49 45 57 64 ... > } },
  awaitingToken: Promise { <pending> } }

from etcd3.

Unfortunately this sounds like a (possible) issue in grpc, not this library, so the amount of help I can provide is limited. The message you're seeing is bubbling up from the native code in grpc, you may have better luck opening an issue there.

from etcd3.