I am trying to do a curl request using a client certificate like so:
curl -E my.pem https://some.site
And I get the following error message:
curl: (35) error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
- What does this mean?
- Is this complaint coming from the server to which I am connecting, or my curl client?
- (How do I determine) what is the ca in this context?
- How do I make it such that the ca is known?
MadHatter
78.9k20 gold badges182 silver badges230 bronze badges
asked Aug 2, 2016 at 2:10
4
If the server sends you a TLS alert unknown ca like in this case then the server does not accept the client certificate you have send (-E my.pem). One reason for this might be that you have used the wrong certificate. Another reason might be that you’ve used the correct certificate but failed to add the necessary chain certificates.
answered Aug 2, 2016 at 7:42
1
Config from ingress pod:
{
"configs": [
{
"@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
"bootstrap": {
"node": {
"id": "router~XX.XX>XX~istio-ingressgateway-556d8ddccd-qbp58.istio-system~istio-system.svc.cluster.local",
"cluster": "istio-ingressgateway",
"metadata": {
"SERVICE_ACCOUNT": "istio-ingressgateway-service-account",
"MESH_ID": "cluster.local",
"SDS": "true",
"WORKLOAD_NAME": "istio-ingressgateway",
"OWNER": "kubernetes://apis/apps/v1/namespaces/istio-system/deployments/istio-ingressgateway",
"ROUTER_MODE": "sni-dnat",
"ISTIO_VERSION": "1.7.4",
"PROXY_CONFIG": {
"controlPlaneAuthPolicy": "MUTUAL_TLS",
"drainDuration": "45s",
"proxyMetadata": {
"DNS_AGENT": ""
},
"terminationDrainDuration": "5s",
"tracing": {
"zipkin": {
"address": "zipkin.istio-system:9411"
}
},
"statusPort": 15020,
"serviceCluster": "istio-ingressgateway",
"envoyMetricsService": {},
"discoveryAddress": "istiod.istio-system.svc:15012",
"binaryPath": "/usr/local/bin/envoy",
"concurrency": 0,
"envoyAccessLogService": {},
"statNameLength": 189,
"configPath": "./etc/istio/proxy",
"parentShutdownDuration": "60s",
"proxyAdminPort": 15000
},
"PLATFORM_METADATA": {
"aws_instance_id": "i-01315f41cb98eba21",
"aws_account_id": "346303860452",
"aws_availability_zone": "us-west-2a",
"aws_region": "us-west-2"
},
"CLUSTER_ID": "Kubernetes",
"LABELS": {
"app": "istio-ingressgateway",
"service.istio.io/canonical-revision": "latest",
"pod-template-hash": "556d8ddccd",
"heritage": "Tiller",
"istio": "ingressgateway",
"chart": "gateways",
"service.istio.io/canonical-name": "istio-ingressgateway",
"release": "istio"
},
"ISTIO_PROXY_SHA": "istio-proxy:5694187abcc4aea15a701bff18858a2e9216e609",
"NAME": "istio-ingressgateway-556d8ddccd-qbp58",
"NAMESPACE": "istio-system",
"EXCHANGE_KEYS": "NAME,NAMESPACE,INSTANCE_IPS,LABELS,OWNER,PLATFORM_METADATA,WORKLOAD_NAME,MESH_ID,SERVICE_ACCOUNT,CLUSTER_ID",
"INSTANCE_IPS": "X.X.X.X"
},
"locality": {
"region": "us-west-2",
"zone": "us-west-2a"
},
"hidden_envoy_deprecated_build_version": "5694187abcc4aea15a701bff18858a2e9216e609/1.15.1-dev/Clean/RELEASE/BoringSSL",
"user_agent_name": "envoy",
"user_agent_build_version": {
"version": {
"major_number": 1,
"minor_number": 15,
"patch": 1
},
"metadata": {
"build.type": "RELEASE",
"ssl.version": "BoringSSL",
"revision.status": "Clean",
"revision.sha": "5694187abcc4aea15a701bff18858a2e9216e609",
"build.label": "dev"
}
},
"extensions": [
{
"name": "raw_udp_listener",
"category": "envoy.udp_listeners"
},
{
"name": "envoy.client_ssl_auth",
"category": "envoy.filters.network"
},
{
"name": "envoy.echo",
"category": "envoy.filters.network"
},
{
"name": "envoy.ext_authz",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.client_ssl_auth",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.direct_response",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.dubbo_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.echo",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.ext_authz",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.http_connection_manager",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.kafka_broker",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.local_ratelimit",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.metadata_exchange",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.mongo_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.mysql_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.postgres_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.ratelimit",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.rbac",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.redis_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.rocketmq_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.sni_cluster",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.sni_dynamic_forward_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.tcp_cluster_rewrite",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.tcp_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.thrift_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.wasm",
"category": "envoy.filters.network"
},
{
"name": "envoy.filters.network.zookeeper_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.http_connection_manager",
"category": "envoy.filters.network"
},
{
"name": "envoy.mongo_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.ratelimit",
"category": "envoy.filters.network"
},
{
"name": "envoy.redis_proxy",
"category": "envoy.filters.network"
},
{
"name": "envoy.tcp_proxy",
"category": "envoy.filters.network"
},
{
"name": "forward_downstream_sni",
"category": "envoy.filters.network"
},
{
"name": "mixer",
"category": "envoy.filters.network"
},
{
"name": "sni_verifier",
"category": "envoy.filters.network"
},
{
"name": "envoy.transport_sockets.alts",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "envoy.transport_sockets.quic",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "envoy.transport_sockets.raw_buffer",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "envoy.transport_sockets.tap",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "envoy.transport_sockets.tls",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "raw_buffer",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "tls",
"category": "envoy.transport_sockets.upstream"
},
{
"name": "envoy.transport_sockets.alts",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "envoy.transport_sockets.quic",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "envoy.transport_sockets.raw_buffer",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "envoy.transport_sockets.tap",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "envoy.transport_sockets.tls",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "raw_buffer",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "tls",
"category": "envoy.transport_sockets.downstream"
},
{
"name": "dubbo.hessian2",
"category": "envoy.dubbo_proxy.serializers"
},
{
"name": "dubbo",
"category": "envoy.dubbo_proxy.protocols"
},
{
"name": "envoy.ip",
"category": "envoy.resolvers"
},
{
"name": "envoy.retry_priorities.previous_priorities",
"category": "envoy.retry_priorities"
},
{
"name": "envoy.resource_monitors.fixed_heap",
"category": "envoy.resource_monitors"
},
{
"name": "envoy.resource_monitors.injected_resource",
"category": "envoy.resource_monitors"
},
{
"name": "envoy.access_loggers.file",
"category": "envoy.access_loggers"
},
{
"name": "envoy.access_loggers.http_grpc",
"category": "envoy.access_loggers"
},
{
"name": "envoy.access_loggers.tcp_grpc",
"category": "envoy.access_loggers"
},
{
"name": "envoy.access_loggers.wasm",
"category": "envoy.access_loggers"
},
{
"name": "envoy.file_access_log",
"category": "envoy.access_loggers"
},
{
"name": "envoy.http_grpc_access_log",
"category": "envoy.access_loggers"
},
{
"name": "envoy.tcp_grpc_access_log",
"category": "envoy.access_loggers"
},
{
"name": "envoy.wasm_access_log",
"category": "envoy.access_loggers"
},
{
"name": "auto",
"category": "envoy.thrift_proxy.transports"
},
{
"name": "framed",
"category": "envoy.thrift_proxy.transports"
},
{
"name": "header",
"category": "envoy.thrift_proxy.transports"
},
{
"name": "unframed",
"category": "envoy.thrift_proxy.transports"
},
{
"name": "envoy.filters.udp.dns_filter",
"category": "envoy.filters.udp_listener"
},
{
"name": "envoy.filters.udp_listener.udp_proxy",
"category": "envoy.filters.udp_listener"
},
{
"name": "envoy.filters.dubbo.router",
"category": "envoy.dubbo_proxy.filters"
},
{
"name": "envoy.dog_statsd",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.metrics_service",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.stat_sinks.dog_statsd",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.stat_sinks.hystrix",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.stat_sinks.metrics_service",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.stat_sinks.statsd",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.statsd",
"category": "envoy.stats_sinks"
},
{
"name": "envoy.filters.connection_pools.http.generic",
"category": "envoy.upstreams"
},
{
"name": "envoy.filters.connection_pools.http.http",
"category": "envoy.upstreams"
},
{
"name": "envoy.filters.connection_pools.http.tcp",
"category": "envoy.upstreams"
},
{
"name": "envoy.bootstrap.wasm",
"category": "envoy.bootstrap"
},
{
"name": "envoy.filters.listener.http_inspector",
"category": "envoy.filters.listener"
},
{
"name": "envoy.filters.listener.original_dst",
"category": "envoy.filters.listener"
},
{
"name": "envoy.filters.listener.original_src",
"category": "envoy.filters.listener"
},
{
"name": "envoy.filters.listener.proxy_protocol",
"category": "envoy.filters.listener"
},
{
"name": "envoy.filters.listener.tls_inspector",
"category": "envoy.filters.listener"
},
{
"name": "envoy.listener.http_inspector",
"category": "envoy.filters.listener"
},
{
"name": "envoy.listener.original_dst",
"category": "envoy.filters.listener"
},
{
"name": "envoy.listener.original_src",
"category": "envoy.filters.listener"
},
{
"name": "envoy.listener.proxy_protocol",
"category": "envoy.filters.listener"
},
{
"name": "envoy.listener.tls_inspector",
"category": "envoy.filters.listener"
},
{
"name": "envoy.dynamic.ot",
"category": "envoy.tracers"
},
{
"name": "envoy.lightstep",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.datadog",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.dynamic_ot",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.lightstep",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.opencensus",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.xray",
"category": "envoy.tracers"
},
{
"name": "envoy.tracers.zipkin",
"category": "envoy.tracers"
},
{
"name": "envoy.zipkin",
"category": "envoy.tracers"
},
{
"name": "default",
"category": "envoy.dubbo_proxy.route_matchers"
},
{
"name": "envoy.cluster.eds",
"category": "envoy.clusters"
},
{
"name": "envoy.cluster.logical_dns",
"category": "envoy.clusters"
},
{
"name": "envoy.cluster.original_dst",
"category": "envoy.clusters"
},
{
"name": "envoy.cluster.static",
"category": "envoy.clusters"
},
{
"name": "envoy.cluster.strict_dns",
"category": "envoy.clusters"
},
{
"name": "envoy.clusters.aggregate",
"category": "envoy.clusters"
},
{
"name": "envoy.clusters.dynamic_forward_proxy",
"category": "envoy.clusters"
},
{
"name": "envoy.clusters.redis",
"category": "envoy.clusters"
},
{
"name": "envoy.internal_redirect_predicates.allow_listed_routes",
"category": "envoy.internal_redirect_predicates"
},
{
"name": "envoy.internal_redirect_predicates.previous_routes",
"category": "envoy.internal_redirect_predicates"
},
{
"name": "envoy.internal_redirect_predicates.safe_cross_scheme",
"category": "envoy.internal_redirect_predicates"
},
{
"name": "envoy.retry_host_predicates.omit_canary_hosts",
"category": "envoy.retry_host_predicates"
},
{
"name": "envoy.retry_host_predicates.omit_host_metadata",
"category": "envoy.retry_host_predicates"
},
{
"name": "envoy.retry_host_predicates.previous_hosts",
"category": "envoy.retry_host_predicates"
},
{
"name": "envoy.compression.gzip.compressor",
"category": "envoy.compression.compressor"
},
{
"name": "envoy.compression.gzip.decompressor",
"category": "envoy.compression.decompressor"
},
{
"name": "envoy.filters.thrift.rate_limit",
"category": "envoy.thrift_proxy.filters"
},
{
"name": "envoy.filters.thrift.router",
"category": "envoy.thrift_proxy.filters"
},
{
"name": "envoy.grpc_credentials.aws_iam",
"category": "envoy.grpc_credentials"
},
{
"name": "envoy.grpc_credentials.default",
"category": "envoy.grpc_credentials"
},
{
"name": "envoy.grpc_credentials.file_based_metadata",
"category": "envoy.grpc_credentials"
},
{
"name": "auto",
"category": "envoy.thrift_proxy.protocols"
},
{
"name": "binary",
"category": "envoy.thrift_proxy.protocols"
},
{
"name": "binary/non-strict",
"category": "envoy.thrift_proxy.protocols"
},
{
"name": "compact",
"category": "envoy.thrift_proxy.protocols"
},
{
"name": "twitter",
"category": "envoy.thrift_proxy.protocols"
},
{
"name": "envoy.filters.network.upstream.metadata_exchange",
"category": "envoy.filters.upstream_network"
},
{
"name": "envoy.buffer",
"category": "envoy.filters.http"
},
{
"name": "envoy.cors",
"category": "envoy.filters.http"
},
{
"name": "envoy.csrf",
"category": "envoy.filters.http"
},
{
"name": "envoy.ext_authz",
"category": "envoy.filters.http"
},
{
"name": "envoy.fault",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.adaptive_concurrency",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.admission_control",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.aws_lambda",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.aws_request_signing",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.buffer",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.cache",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.compressor",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.cors",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.csrf",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.decompressor",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.dynamic_forward_proxy",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.dynamo",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.ext_authz",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.fault",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.grpc_http1_bridge",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.grpc_http1_reverse_bridge",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.grpc_json_transcoder",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.grpc_stats",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.grpc_web",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.gzip",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.header_to_metadata",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.health_check",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.ip_tagging",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.jwt_authn",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.lua",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.on_demand",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.original_src",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.ratelimit",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.rbac",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.router",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.squash",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.tap",
"category": "envoy.filters.http"
},
{
"name": "envoy.filters.http.wasm",
"category": "envoy.filters.http"
},
{
"name": "envoy.grpc_http1_bridge",
"category": "envoy.filters.http"
},
{
"name": "envoy.grpc_json_transcoder",
"category": "envoy.filters.http"
},
{
"name": "envoy.grpc_web",
"category": "envoy.filters.http"
},
{
"name": "envoy.gzip",
"category": "envoy.filters.http"
},
{
"name": "envoy.health_check",
"category": "envoy.filters.http"
},
{
"name": "envoy.http_dynamo_filter",
"category": "envoy.filters.http"
},
{
"name": "envoy.ip_tagging",
"category": "envoy.filters.http"
},
{
"name": "envoy.lua",
"category": "envoy.filters.http"
},
{
"name": "envoy.rate_limit",
"category": "envoy.filters.http"
},
{
"name": "envoy.router",
"category": "envoy.filters.http"
},
{
"name": "envoy.squash",
"category": "envoy.filters.http"
},
{
"name": "istio.alpn",
"category": "envoy.filters.http"
},
{
"name": "istio_authn",
"category": "envoy.filters.http"
},
{
"name": "mixer",
"category": "envoy.filters.http"
},
{
"name": "envoy.health_checkers.redis",
"category": "envoy.health_checkers"
},
{
"name": "envoy.extensions.http.cache.simple",
"category": "http_cache_factory"
}
]
},
"static_resources": {
"listeners": [
{
"address": {
"socket_address": {
"address": "0.0.0.0",
"port_value": 15090
}
},
"filter_chains": [
{
"filters": [
{
"name": "envoy.http_connection_manager",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
"stat_prefix": "stats",
"route_config": {
"virtual_hosts": [
{
"name": "backend",
"domains": [
"*"
],
"routes": [
{
"match": {
"prefix": "/stats/prometheus"
},
"route": {
"cluster": "prometheus_stats"
}
}
]
}
]
},
"http_filters": [
{
"name": "envoy.router",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
}
}
]
}
}
]
}
]
},
{
"address": {
"socket_address": {
"address": "0.0.0.0",
"port_value": 15021
}
},
"filter_chains": [
{
"filters": [
{
"name": "envoy.http_connection_manager",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
"stat_prefix": "agent",
"route_config": {
"virtual_hosts": [
{
"name": "backend",
"domains": [
"*"
],
"routes": [
{
"match": {
"prefix": "/healthz/ready"
},
"route": {
"cluster": "agent"
}
}
]
}
]
},
"http_filters": [
{
"name": "envoy.router",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
}
}
]
}
}
]
}
]
}
],
"clusters": [
{
"name": "prometheus_stats",
"type": "STATIC",
"connect_timeout": "0.250s",
"load_assignment": {
"cluster_name": "prometheus_stats",
"endpoints": [
{
"lb_endpoints": [
{
"endpoint": {
"address": {
"socket_address": {
"address": "127.0.0.1",
"port_value": 15000
}
}
}
}
]
}
]
}
},
{
"name": "agent",
"type": "STATIC",
"connect_timeout": "0.250s",
"load_assignment": {
"cluster_name": "prometheus_stats",
"endpoints": [
{
"lb_endpoints": [
{
"endpoint": {
"address": {
"socket_address": {
"address": "127.0.0.1",
"port_value": 15020
}
}
}
}
]
}
]
}
},
{
"name": "sds-grpc",
"type": "STATIC",
"connect_timeout": "1s",
"http2_protocol_options": {},
"load_assignment": {
"cluster_name": "sds-grpc",
"endpoints": [
{
"lb_endpoints": [
{
"endpoint": {
"address": {
"pipe": {
"path": "./etc/istio/proxy/SDS"
}
}
}
}
]
}
]
}
},
{
"name": "xds-grpc",
"type": "STRICT_DNS",
"connect_timeout": "1s",
"max_requests_per_connection": 1,
"circuit_breakers": {
"thresholds": [
{
"max_connections": 100000,
"max_pending_requests": 100000,
"max_requests": 100000
},
{
"priority": "HIGH",
"max_connections": 100000,
"max_pending_requests": 100000,
"max_requests": 100000
}
]
},
"http2_protocol_options": {},
"dns_lookup_family": "V4_ONLY",
"transport_socket": {
"name": "envoy.transport_sockets.tls",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
"common_tls_context": {
"validation_context": {
"trusted_ca": {
"filename": "./var/run/secrets/istio/root-cert.pem"
},
"match_subject_alt_names": [
{
"exact": "istiod.istio-system.svc"
}
]
},
"alpn_protocols": [
"h2"
],
"tls_certificate_sds_secret_configs": [
{
"name": "default",
"sds_config": {
"api_config_source": {
"api_type": "GRPC",
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "sds-grpc"
}
}
],
"transport_api_version": "V3"
},
"initial_fetch_timeout": "0s",
"resource_api_version": "V3"
}
}
]
},
"sni": "istiod.istio-system.svc"
}
},
"upstream_connection_options": {
"tcp_keepalive": {
"keepalive_time": 300
}
},
"load_assignment": {
"cluster_name": "xds-grpc",
"endpoints": [
{
"lb_endpoints": [
{
"endpoint": {
"address": {
"socket_address": {
"address": "istiod.istio-system.svc",
"port_value": 15012
}
}
}
}
]
}
]
},
"respect_dns_ttl": true
},
{
"name": "zipkin",
"type": "STRICT_DNS",
"connect_timeout": "1s",
"dns_lookup_family": "V4_ONLY",
"load_assignment": {
"cluster_name": "zipkin",
"endpoints": [
{
"lb_endpoints": [
{
"endpoint": {
"address": {
"socket_address": {
"address": "zipkin.istio-system",
"port_value": 9411
}
}
}
}
]
}
]
},
"respect_dns_ttl": true
}
]
},
"dynamic_resources": {
"lds_config": {
"ads": {},
"resource_api_version": "V3"
},
"cds_config": {
"ads": {},
"resource_api_version": "V3"
},
"ads_config": {
"api_type": "GRPC",
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "xds-grpc"
}
}
],
"transport_api_version": "V3"
}
},
"tracing": {
"http": {
"name": "envoy.zipkin",
"typed_config": {
"@type": "type.googleapis.com/envoy.config.trace.v3.ZipkinConfig",
"collector_cluster": "zipkin",
"collector_endpoint": "/api/v2/spans",
"trace_id_128bit": true,
"shared_span_context": false,
"collector_endpoint_version": "HTTP_JSON"
}
}
},
"admin": {
"access_log_path": "/dev/null",
"profile_path": "/var/lib/istio/data/envoy.prof",
"address": {
"socket_address": {
"address": "127.0.0.1",
"port_value": 15000
}
}
},
"stats_config": {
"stats_tags": [
{
"tag_name": "cluster_name",
"regex": "^cluster\.((.+?(\..+?\.svc\.cluster\.local)?)\.)"
},
{
"tag_name": "tcp_prefix",
"regex": "^tcp\.((.*?)\.)\w+?$"
},
{
"tag_name": "response_code",
"regex": "(response_code=\.=(.+?);\.;)|_rq(_(\.d{3}))$"
},
{
"tag_name": "response_code_class",
"regex": "_rq(_(\dxx))$"
},
{
"tag_name": "http_conn_manager_listener_prefix",
"regex": "^listener(?=\.).*?\.http\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)"
},
{
"tag_name": "http_conn_manager_prefix",
"regex": "^http\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)"
},
{
"tag_name": "listener_address",
"regex": "^listener\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)"
},
{
"tag_name": "mongo_prefix",
"regex": "^mongo\.(.+?)\.(collection|cmd|cx_|op_|delays_|decoding_)(.*?)$"
},
{
"tag_name": "reporter",
"regex": "(reporter=\.=(.*?);\.;)"
},
{
"tag_name": "source_namespace",
"regex": "(source_namespace=\.=(.*?);\.;)"
},
{
"tag_name": "source_workload",
"regex": "(source_workload=\.=(.*?);\.;)"
},
{
"tag_name": "source_workload_namespace",
"regex": "(source_workload_namespace=\.=(.*?);\.;)"
},
{
"tag_name": "source_principal",
"regex": "(source_principal=\.=(.*?);\.;)"
},
{
"tag_name": "source_app",
"regex": "(source_app=\.=(.*?);\.;)"
},
{
"tag_name": "source_version",
"regex": "(source_version=\.=(.*?);\.;)"
},
{
"tag_name": "source_cluster",
"regex": "(source_cluster=\.=(.*?);\.;)"
},
{
"tag_name": "destination_namespace",
"regex": "(destination_namespace=\.=(.*?);\.;)"
},
{
"tag_name": "destination_workload",
"regex": "(destination_workload=\.=(.*?);\.;)"
},
{
"tag_name": "destination_workload_namespace",
"regex": "(destination_workload_namespace=\.=(.*?);\.;)"
},
{
"tag_name": "destination_principal",
"regex": "(destination_principal=\.=(.*?);\.;)"
},
{
"tag_name": "destination_app",
"regex": "(destination_app=\.=(.*?);\.;)"
},
{
"tag_name": "destination_version",
"regex": "(destination_version=\.=(.*?);\.;)"
},
{
"tag_name": "destination_service",
"regex": "(destination_service=\.=(.*?);\.;)"
},
{
"tag_name": "destination_service_name",
"regex": "(destination_service_name=\.=(.*?);\.;)"
},
{
"tag_name": "destination_service_namespace",
"regex": "(destination_service_namespace=\.=(.*?);\.;)"
},
{
"tag_name": "destination_port",
"regex": "(destination_port=\.=(.*?);\.;)"
},
{
"tag_name": "destination_cluster",
"regex": "(destination_cluster=\.=(.*?);\.;)"
},
{
"tag_name": "request_protocol",
"regex": "(request_protocol=\.=(.*?);\.;)"
},
{
"tag_name": "request_operation",
"regex": "(request_operation=\.=(.*?);\.;)"
},
{
"tag_name": "request_host",
"regex": "(request_host=\.=(.*?);\.;)"
},
{
"tag_name": "response_flags",
"regex": "(response_flags=\.=(.*?);\.;)"
},
{
"tag_name": "grpc_response_status",
"regex": "(grpc_response_status=\.=(.*?);\.;)"
},
{
"tag_name": "connection_security_policy",
"regex": "(connection_security_policy=\.=(.*?);\.;)"
},
{
"tag_name": "permissive_response_code",
"regex": "(permissive_response_code=\.=(.*?);\.;)"
},
{
"tag_name": "permissive_response_policyid",
"regex": "(permissive_response_policyid=\.=(.*?);\.;)"
},
{
"tag_name": "source_canonical_service",
"regex": "(source_canonical_service=\.=(.*?);\.;)"
},
{
"tag_name": "destination_canonical_service",
"regex": "(destination_canonical_service=\.=(.*?);\.;)"
},
{
"tag_name": "source_canonical_revision",
"regex": "(source_canonical_revision=\.=(.*?);\.;)"
},
{
"tag_name": "destination_canonical_revision",
"regex": "(destination_canonical_revision=\.=(.*?);\.;)"
},
{
"tag_name": "cache",
"regex": "(cache\.(.+?)\.)"
},
{
"tag_name": "component",
"regex": "(component\.(.+?)\.)"
},
{
"tag_name": "tag",
"regex": "(tag\.(.+?);\.)"
},
{
"tag_name": "wasm_filter",
"regex": "(wasm_filter\.(.+?)\.)"
}
],
"use_all_default_tags": false,
"stats_matcher": {
"inclusion_list": {
"patterns": [
{
"prefix": "reporter="
},
{
"prefix": "cluster_manager"
},
{
"prefix": "listener_manager"
},
{
"prefix": "http_mixer_filter"
},
{
"prefix": "tcp_mixer_filter"
},
{
"prefix": "server"
},
{
"prefix": "cluster.xds-grpc"
},
{
"prefix": "wasm"
},
{
"prefix": "component"
}
]
}
}
},
"layered_runtime": {
"layers": [
{
"name": "deprecation",
"static_layer": {
"envoy.deprecated_features:envoy.config.listener.v3.Listener.hidden_envoy_deprecated_use_original_dst": true
}
},
{
"name": "admin",
"admin_layer": {}
}
]
}
},
"last_updated": "2020-11-03T02:06:23.168Z"
},
}
udo
Famous Member
-
#1
Hi,
we are migrating from our pve3.4-cluster to an new pve4.1 (enterprise repository) cluster.
Do an fresh install on one node (named prox-01) and change the ssl-files like here discribed: http://pve.proxmox.com/wiki/HTTPSCertificateConfiguration
Transfer some VMs — all work well.
Do an fresh install on the second node (prox-02), change the SSL-Files too and join the cluster.
Work, but with an SSL error, because update certs won’t work…
But then I got issues with prox-01 (update certs empty the file /etc/pve/nodes/prox-01/pve-ssl.pem).
I replace pve-ssl.pem with the right file (same config like on prox-02).
The Web-SSL config is ok (checked with openssl s_client -connect prox-01…).
But if I logged in on node prox-01 and open an Console — after an short time the Console changed to disconnected, switched back, and so on.
Error messages:
Code:
Mar 15 13:36:50 prox-01 pveproxy[3585]: problem with client 172.20.4.200; ssl3_read_bytes: tlsv1 alert unknown ca
Mar 15 13:36:50 prox-01 pveproxy[3585]: proxy detected vanished client connection
Mar 15 13:36:52 prox-01 pveproxy[3585]: problem with client 172.20.4.200; ssl3_read_bytes: tlsv1 alert unknown ca
Mar 15 13:36:52 prox-01 pveproxy[3585]: proxy detected vanished client connection
Mar 15 13:36:55 prox-01 pveproxy[3584]: problem with client 172.20.4.200; ssl3_read_bytes: tlsv1 alert unknown ca
Mar 15 13:36:55 prox-01 pveproxy[3584]: Can't call method "timeout_reset" on an undefined value at /usr/share/perl5/PVE/HTTPServer.pm line 225The same happens after an reboot of node prox-01.
If I logged in on prox-02, I can open an Console of an prox-01-VM… but get often an message displayed «ssl3_read_bytes: tlsv1 alert unknown ca (596)».
Files looks correct (key is an wildcard-key):
Code:
root@prox-01:~# diff /etc/pve/nodes/prox-01/pve-ssl.pem /etc/pve/nodes/prox-02/pve-ssl.pem
root@prox-01:~# diff /etc/pve/nodes/prox-01/pve-ssl.key /etc/pve/nodes/prox-02/pve-ssl.keyCode:
pveversion -v
proxmox-ve: 4.1-39 (running kernel: 4.2.8-1-pve)
pve-manager: 4.1-15 (running version: 4.1-15/8cd55b52)
pve-kernel-4.2.6-1-pve: 4.2.6-36
pve-kernel-4.2.8-1-pve: 4.2.8-39
lvm2: 2.02.116-pve2
corosync-pve: 2.3.5-2
libqb0: 1.0-1
pve-cluster: 4.0-33
qemu-server: 4.0-62
pve-firmware: 1.1-7
libpve-common-perl: 4.0-49
libpve-access-control: 4.0-11
libpve-storage-perl: 4.0-42
pve-libspice-server1: 0.12.5-2
vncterm: 1.2-1
pve-qemu-kvm: 2.5-9
pve-container: 1.0-46
pve-firewall: 2.0-18
pve-ha-manager: 1.0-24
ksm-control-daemon: 1.2-1
glusterfs-client: 3.5.2-2+deb8u1
lxc-pve: 1.1.5-7
lxcfs: 2.0.0-pve1
cgmanager: 0.39-pve1
criu: 1.6.0-1
zfsutils: 0.6.5-pve7~jessie
openvswitch-switch: 2.3.2-2Code:
openssl s_client -CAfile ca.pem -connect prox-01.xxxxxxxxxx.com:8006
CONNECTED(00000003)
depth=2 O = Root CA, OU = http://www.cacert.org, CN = CA Cert Signing Authority, emailAddress = support@cacert.org
verify return:1
depth=1 O = CAcert Inc., OU = http://www.CAcert.org, CN = CAcert Class 3 Root
verify return:1
depth=0 C = DE, ST = Hamburg, L = Hamburg, O = XXXXXXXXXXXX, CN = *.xxxxxxxxxx.com
verify return:1
---
Certificate chain
0 s:/C=DE/ST=Hamburg/L=Hamburg/O=XXXXXXXXXXXX/CN=*.xxxxxxxxxx.com
i:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root
1 s:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root
i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org
2 s:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org
i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF1TCCA72gAwIBAgIDAmgIMA0GCSqGSIb3DQEBCwUAMFQxFDASBgNVBAoTC0NB
Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV
BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTUwNTE5MTU0NTM4WhcNMTcwNTE4
MTU0NTM4WjB8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVyZzEQMA4GA1UE
BxMHSGFtYnVyZzEtMCsGA1UEChQkQWxiZXJ0IEJhdWVyIENvbXBhbmllcyBHbWJI
ICYgQ28uIEtHMRowGAYDVQQDFBEqLmFsYmVydGJhdWVyLmNvbTCCAaIwDQYJKoZI
hvcNAQEBBQADggGPADCCAYoCggGBAMjOaoLYRzG2b8Pd+NMJsbQ7E/4cyQk5llGg
ytuvPeiPcQCYx01iKNlAVwLyMZ1VK5CAtkrztReH27R+/2QAJIxA73uAz10jj0XO
QzFu4evLMr1ClHoT4YA1wMUOFSFD6vgCr9eA/zl5Ba96khNzwAmrg846ndnMrLzw
DcSGQG3v+Jdd65DQHu+MNROvLurZ2xEpsLX+C4/jRRGUdWkcOZVXnmtWEZiiftaU
C48//iMJiaTeRsufH1+TG9EfdD7B4IafhWK1+Hsyf+UObw4SBUI7Nv6LnWKJP+gC
Qr/7PvE9Lu/IGpQQrRdwivUqoSCq2UMqK+uqhe3I3/5SjdaaaaluSRtX+mHi2z79
fQjNaRuutRn33hFFV9aYLKnSTf2wY3y3UObe07/F9MFCQX/mBsi5fwiiitMUgAET
8oWEJG3veSgmC0rHRANpoW6cD4YlrVyOQRgGzLuPtFKgc1f3Pn4ysAQ9MO/vxZkA
tKk1L5Wky+NRGEpkcWmC3RuUE2dkQQIDAQABo4IBBjCCAQIwDAYDVR0TAQH/BAIw
ADAOBgNVHQ8BAf8EBAMCA6gwNAYDVR0lBC0wKwYIKwYBBQUHAwIGCCsGAQUFBwMB
BglghkgBhvhCBAEGCisGAQQBgjcKAwMwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUF
BzABhhdodHRwOi8vb2NzcC5jYWNlcnQub3JnLzA4BgNVHR8EMTAvMC2gK6Aphido
dHRwOi8vY3JsLmNhY2VydC5vcmcvY2xhc3MzLXJldm9rZS5jcmwwPQYDVR0RBDYw
NIIRKi5hbGJlcnRiYXVlci5jb22gHwYIKwYBBQUHCAWgEwwRKi5hbGJlcnRiYXVl
ci5jb20wDQYJKoZIhvcNAQELBQADggIBAAIlCWYaSbkpJnhXvE9hPsi6uNFfIovv
9d2eiv2MD2A2V3EgqjfMOxWua/LiV6n+zDYzk/R9DYdi1ozwmQ9xnLU8206JMXLJ
PFaqRDtXBqtMckCZuJ2B7yTiPigAPcN9wEOfrpjdKzEx9XjE8bQBx+NmDNgBcwEk
tAlgWichKDHwhwbHWKhgQfRCT7QAnRBTZz1Prmkn04NNK7k9kISRFevOruKFJIBB
d7N09YneYXwfUepmcxmSxXimhUQJC9evV23nnQqUM9dW+H9t4iZ4AgZo/Po2U4IF
kPCE57KzEJcOMNv6EVx6DS5KU0Gmge0L+q1KEjuv9hgHY6yYDqkRnZ/hWOKmSzfc
sFBkPaYFd+ICsJH6P0nZTEPAxKdjvY1FlOfdacuGt2GS9I/bESx9jLPlCkb6FrAV
Q+y4U7EFEPgoBmasMeXGwncXmPtXfeVUkuhwU0Soh4EYLLUGbPe/adOregvAxxQX
iFZ7BwJGmrunDxc31n7+HTf+I6XWnJF2AoVT/ZKqmvSdVp0Wx4tEFiuqlBaBivpV
cvRZjVQlaiN2n0jynODMxNh4W+k81YzIAJgnRZWkmn1tX2Fz71+PXy43QmU//q7R
bSgyRQ/bk7auqlyxlhKemizLluPjjZ5kXalnVA8AMRTZginAwGuz8DTXt6R6gTwv
Wu1Y2Y6AMRHi
-----END CERTIFICATE-----
subject=/C=DE/ST=Hamburg/L=Hamburg/O=XXXXXXXXXXXX/CN=*.xxxxxxxxxx.com
issuer=/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root
---
No client certificate CA names sent
---
SSL handshake has read 6474 bytes and written 607 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 3072 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-GCM-SHA384
Session-ID: 6A562C373F9B6BC7548D2C39DAF7CCDDDAB89A4152F308BB073A0D9F6DC7DC26
Session-ID-ctx:
Master-Key: E0BEACEB67F4428E5C1DEC279845013A34B8FEBF6B1852A2E9D7AFED6A4DBBD8223EFEF92C45149DF8CB20AD1EFDD5EB
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 6f 37 22 95 a0 57 23 82-d9 0e ad 5c e8 59 a7 0c o7"..W#.....Y..
0010 - 97 f7 f5 5e 66 b6 31 f6-1f 3d b4 88 64 ae f0 13 ...^f.1..=..d...
0020 - 4e e7 3b 67 45 9e c4 5a-fd 75 15 a0 f2 32 36 95 N.;gE..Z.u...26.
0030 - cf 1a 60 7a 4a ca 17 7a-91 be 58 8a 6d 81 3b 91 ..`zJ..z..X.m.;.
0040 - d8 9b ec a6 40 16 11 c7-d8 70 32 95 d9 79 73 c6 ....@....p2..ys.
0050 - 19 81 d4 47 2c 11 00 7e-a4 43 61 11 a4 01 27 ae ...G,..~.Ca...'.
0060 - ba b2 4e 28 4c 87 cf 6e-b2 ab 32 40 f6 02 8d 21 ..N(L..n..2@...!
0070 - f6 39 b9 74 ec d2 92 ab-5c 15 13 9f ed 69 80 de .9.t........i..
0080 - 1f 17 45 ba a3 2a 73 cc-ec 55 2a dc 17 93 4a f2 ..E..*s..U*...J.
0090 - 04 33 95 40 d0 d5 e3 a4-56 5c 23 b8 28 24 b3 89 .3.@....V#.($..
Start Time: 1458045806
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
read:errno=0Any hints?
Udo
Last edited: Mar 15, 2016
udo
Famous Member
-
#2
Hi,
seems that the issue was the missing content of /etc/pve/nodes/prox-01/pve-ssl.pem and after that the browser cache…
Restart from browser (which I have done before) fix the issue.
sorry for the noise
Udo
Another fun SSL issue today. We managed to get request signing working with a self signed certificate (see this post) but once we bought a real certificate from Gandi things stopped working.
Gandi provided us with a public certificate and a private key, as well as a link to their intermediate certificates. They provide SHA1 and SHA2 certificates, so the first thing to do was to work out which we needed. openssl can help with that
bash
openssl x509 -text -in /path/to/certificate | grep "Signature Algorithm"
=> Signature Algorithm: sha256WithRSAEncryption
In this case, it’s a SHA2 certificate.
Next, we need to generate a public certificate bundle that identifies our key. We can use openssl again to make sure that the chain verifies.
bash
$ cat public.crt | openssl verify
=> stdin: OU = Domain Control Validated, OU = Gandi Standard SSL, CN = sub.example.com
error 20 at 0 depth lookup:unable to get local issuer certificate
As we can see, providing just our public certificate means that it can’t verify the chain. Let’s try adding the intermediate certificates too
bash
$ cat inter.crt public.crt | openssl verify
=> stdin: C = FR, ST = Paris, L = Paris, O = Gandi, CN = Gandi Standard SSL CA 2
error 20 at 0 depth lookup:unable to get local issuer certificate
```
This time we get another error - it couldn't verify Gandi's intermediate certificate. We need to find a trusted certificate that was used to sign Gandi's intermediate certificates. This is provided on Gandi's intermediate cert page under the "Cross Signed Certificate" header.
```bash
$ cat root.crt inter.crt public.crt | openssl verify
=> stdin: OK
Once we add this, the chain of certificates verifies correctly.
At the moment, my Apache virtualhost looks something like this:
<VirtualHost *:443> DocumentRoot /var/www/site SSLEngine On SSLCertificateFile /etc/ssl/oursite/all.crt SSLCertificateKeyFile /etc/ssl/oursite/all.key SSLVerifyClient optional SSLVerifyDepth 2 SSLOptions +StdEnvVars SSLCACertificateFile /etc/ssl/gandi/ca-chain.pem </VirtualHost>
The SSLCACertificateFile option expects a certificate chain to trust, with our public key first and the key that signed it directly after.
We can generate the file by concatenating everything that verified together
bash
cat public.crt inter.crt root.crt > ca-chain.pem
This should contain everything that Apache needs to verify our client certificate. However, when I make a request I get an «unknown ca» alert.
bash
$ curl -v --cert cert --cacert ../ssl/foobar/ca.crt https://ec2-1-2-3-4.compute-1.amazonaws.com
* Rebuilt URL to: https://ec2-1-2-3-4.compute-1.amazonaws.com/
* Hostname was NOT found in DNS cache
* Trying 1.2.3.4...
* Connected to ec2-1-2-3-4.compute-1.amazonaws.com (1.2.3.4) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: ../ssl/oursite/ca.crt
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Request CERT (13):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS handshake, CERT verify (15):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS alert, Server hello (2):
* error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
* Closing connection 0
curl: (35) error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
I wasn’t sure if this was an issue on the client or server side to start with as I’m using a self signed certificate on the server. However, if I tried the request without the --cert option it worked fine. I’ve since confirmed that this error is the server rejecting the client certificate because of an unknown CA
But, how is this possible? We ran everything through openssl and it verified fine. After many hours of searching and trying various things (yes, the ca-chain.pem file needs to be public at the top, root CA at the bottom, definitely) we enabled the Apache debug log by adding LogLevel debug to our Virtualhost.
After restarting Apache and running tail -f /var/log/apache2/error.log, we noticed the following error appearing:
[Wed Jun 17 11:34:27.181869 2015] [ssl:info] [pid 6112] [client 134.225.2.2:44048] AH02276: Certificate Verification: Error (20): unable to get local issuer certificate [subject: CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US / issuer: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE / serial: 13EA28705BF4ECED0C36630980614336 / notbefore: May 30 10:48:38 2000 GMT / notafter: May 30 10:48:38 2020 GMT
It looks as though the UserTrust certificate that Gandi provide isn’t being trusted, and Apache is looking for the AddTrust CA Certificate. Searching Google for «AddTrust CA root» lead me to a comodo knowledgebase page which provides the certificate.
Appending addtrustexternalcaroot.crt to ca-chain.pem and restarting Apache worked, and once I’d restarted Apache I could make my request fine.
The AddTrust CA certificate can replace the UserTrust certificate, so to generate a complete CA chain for certificates signed by Gandi, you need the following certificates in order:
- Your public cert
- Gandi intermediate certificates (SHA2)
- AddTrust cert
You can verify that all of the correct CA certificates are loaded with the following command (where combined.pem is your private key and public cert concatenated):
bash
openssl s_client -cert /path/to/combined.pem -connect ec2-1-2-3-4.compute-1.amazonaws.com:443
There should be a section in the response that contains the following:
Acceptable client certificate CA names /C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2 /OU=Domain Control Validated/OU=Gandi Standard SSL/CN=sub.example.com /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
If you’re missing any of them, double check ca-chain.pem and make sure that all the certificates that you’re expecting are in there.
I have a PHP application with apache and SSL.
It was failing on authentication.
The ssl error logs were as below
AH02008: SSL library error 1 in handshake
SSL Library Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (SSL alert number 48)
The apache ssl configuration was fine as below.
SSLCertificateFile Certificate file path
SSLCertificateKeyFile Key file path
SSLCertificateChainFile Intermediate bundle path
I tested the SSL with the site – https://www.sslshopper.com/ssl-checker.html
It reported as below
The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. Learn more about this error. You can fix this by following GoDaddy’s Certificate Installation Instructions for your server platform. Pay attention to the parts about Intermediate certificates.
The intermediate certificate, aka bundle file may be an issue.
To verify it, ran the following commands.
openssl verify /etc/ssl/certs/cert.pem
gives me the following error:
error 20 at 0 depth lookup:unable to get local issuer certificate
We have to give the path of the intermediate CA certificate to verify the pem file.
openssl verify -CAfile /etc/apache2/ssl.crt/sf_bundle-g2-g1.crt /etc/ssl/certs/cert.pem
It gave the error as
Error loading file /etc/apache2/ssl.crt/sf_bundle-g2-g1.crt
It seems that there are some issues with sf_bundle-g2-g1.crt
I downloaded a fresh sf_bundle-g2-g1.crt file from GoDaddy site.
https://certs.godaddy.com/repository/
https://certs.godaddy.com/repository/sf_bundle-g2-g1.crt
and placed in /etc/apache2/ssl.crt/
Now the command works fine.
openssl verify -CAfile /etc/apache2/ssl.crt/sf_bundle-g2-g1.crt /etc/ssl/certs/cert.pem
/etc/ssl/certs/cert.pem: OK
And now, the web application can allows the users to login.
Thanks to the following links.
http://w3facility.org/question/trouble-connecting-to-ssl-encrypted-web-service-with-php/
http://www.herongyang.com/Cryptography/OpenSSL-Certificate-Path-Validation-Tests.html
http://stackoverflow.com/questions/26260445/openssl-unable-to-get-local-issuer-certificate-debian
http://serverfault.com/questions/582438/how-to-verify-signed-certificate
https://www.sslshopper.com/ssl-checker.html
https://certs.godaddy.com/repository/
http://serverfault.com/questions/655995/roundcube-postfix-smtp-ssl-routinesssl3-read-bytestlsv1-alert-unknown-cas3
I’m trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you’ll get errors. I feel that I’m missing something in this process, so I’ll go step-by-step. I’m not TLS expert, so please bear with me.
I’m using ketyool on a Nexus3:3.30.0 container to generate .jks and .pem file. Container is hosted on a RHEL8 workstation.
The .jks and .pem files are generated under /ops/sonatype/nexus/etc/ssl and I use the following commands:
keytool -genkeypair -alias <alias-goes-here> -keyalg RSA -keysize 2048 -validity 365 -keystore <name of file here>.jks
I answer the following questions:
first and last name - name of internal CA here
org unit - name of org unit here
org - name of company here
city - name of city here
state - name of state here
country code - name of country here
I validate the .jks file with the following command: keytool -list -v -keystore <name of jks file here.jks
I generate the .pem file with the following command:
keytool -certreq -alias <alias here> -file <name of pem here>.pem -keystore <name of jks file here>.jks ext 'SAN=DNS entries here'
The .pem file is then sent to an internal Microsoft Active Directory Certificate Services, to submit a certificate request. I paste the output into the Save Request Field, From Certificate Template, from the drop down Web Server and click submit.
I get a .p7b file, from there I go thru a process of extracting the root, intermediate and server certificate, along with giving them a meaningful names, for example root-server.cer, so it makes it easier to keep track of what cert is what.
I move these .cer files back to to the container and import them in the following order: root, intermediate and then server. Using the following commands:
keytool -importcert -file root-cert.cer -keystore <name of jks file>.jks -alias root-cert
keytool -importcert -file intermediate-cert.cer -keystore <name of jks file>.jks -alias intermediate-cert
keytool -importcert -file server-cert.cer -keystore <name of jks file>.jks -alias server-cert
I confirm that all certs have been imported into the keystore with the following command: keytool -list -v -keystore <name of jks file>.jks
I go thru a few configuration of the Nexus container itself to prepare it for HTTPS. Once done, I restart the container and refresh the browser and the UI comes back up as HTTPS. However the Icon Lock in the browser shows Connection is Not Secure.
Upon further investigation with command line tools like curl and openssl, I’ve determine that something has gone wrong.
This is the output of the curl command I use against the container:
[user_a@host_a tmp]$ curl -l -v https://10.88.0.214:8082
* Rebuilt URL to: https://10.88.0.214:8082/
* Trying 10.88.0.214...
* TCP_NODELAY set
* Connected to 10.88.0.214 (10.88.0.214) port 8082 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Any of the openssl commands that I used, for example:
openssl s_client --connect <ip address here:port number here> --showcerts
Any of the output shows
Verification error: self signed certificate
Why is this showing this? The certificate is not self-signed as it went to an internal CA, which lives on a Windows server. Or should this even matter?
Are there are other commands that I can run to help troubleshoot, to get more info?
Is there something that I need to do since I’m moving from a Linux based container to an internal Windows CA?
Am I missing any steps in this process?
thanks in advance
Hello,
I’m having an issue that I could use other IT professional’s suggestions to solve. The problem I have is an Apache Web Server hosted by Liquid Web which hosts my company’s website reaches out to a local Windows Server running IIS 8.0 in my data center. The Windows server contains a SQL database. The Apache Web Server executes a Soap script reaching out to a public IP address designed for the local server’s firewall and it’s outside interface. The script calls for a executable located in the Websvc folder which then executes an internal script to query the SQL DB for information and then send it back to the Apache Web Server to be displayed for customers. Some time back in June of 2019 the secure TLS 1.2 connection between the Apache Web Server and the local Windows Server running IIS failed and has kept failing ever since. After review of the local firewall logs we see the three-way handshake initiate and the servers then exchange certificates upon which the connection then fails. The follow error message is presented:
Alert (Level: Fatal, Description: Unknown CA).
No. Time Source Destination Protocol Length Info
7 0.087354 X.X.X.134 X.X.X.138 TLSv1.2 73
Alert (Level: Fatal, Description: Unknown CA)
Frame 7: 73 bytes on wire (584 bits), 73 bytes captured (584
bits)
Ethernet II, Src: Cisco_XX:XX:XX (XX:XX:XX:XX:XX:XX), Dst:
AxiomTec_XX:XX:XX (XX:XX:XX:XX:XX:XX)
Internet Protocol Version 4, Src: X.X.X.134, Dst: X.X.X.138
Transmission Control Protocol, Src Port: 58958, Dst Port:
443, Seq: 518, Ack: 1340, Len: 7
Transport Layer Security
The local Window Server has had a self-signed certificate and the Apache Server has a standard SSL certificate. My local server even though it is running IIS is not a public domain and therefore I cannot buy a SSL certificate for it. My question is how might I solve this connection issue so that data can flow again between the hosts?