Skip to main content
Question

SSL setup authentication issue.

  • November 1, 2019
  • 6 replies
  • 14 views
kontactmaneesh

HI All
I am trying to SSL setup for mutual authentication. I am always getting the below issue.

2019-11-01 02:58:29.192 Init Session:0x7f93967fd700 @_node0001: 00000/4691: Sending SSL negotiation response 'S'
2019-11-01 02:58:29.196 Init Session:0x7f93967fd700 @_node0001: 08V01/7244: Could not accept SSL connection (3): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
2019-11-01 02:58:29.196 Init Session:0x7f93967fd700 @_node0001: {SessionRun} 08006/4777: SSL initialization failure

Exectuing from vsql command .
Even i am able to see certificate and ssl enable with help of below commands
SELECT GET_CONFIG_PARAMETER('EnableSSL');
SELECT GET_CONFIG_PARAMETER('SSLPrivateKey');
SELECT GET_CONFIG_PARAMETER('SSLCertificate');
Note : Referred below link for setup .
https://www.vertica.com/docs/9.2.x/HTML/Content/Authoring/KafkaIntegrationGuide/TLS-SSL/KafkaTLS-SSLExamplePart2ConfigureVertica.htm?tocpath=Integrating with Apache Kafka|Using TLS/SSL Encryption with Kafka|_____6
Your early reply will be really appreciated. Thanks a lot in advance.
Thanks
Maneesh Kumar

    6 replies

    SruthiA
    Forum|alt.badge.img+1
    • SruthiA
    • Participating Frequently
    • November 1, 2019

    It looks like a certificate issue or chain or if you have chain of certificates, those were not set appropriately. Please check the below link

    https://michaelheap.com/curl-35-error14094418ssl-routinesssl3_read_bytestlsv1-alert-unknown-ca

    kontactmaneesh
    • kontactmaneesh
    • Author
    • Participating Frequently
    • November 1, 2019

    Even I again generated the certificate and now seeing different issue in vertica.log

    2019-11-01 12:43:53.357 Init Session:0x7fe726bf1700 @v_node0001: 08V01/7244: Could not accept SSL connection (3): error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate
    2019-11-01 12:43:53.357 Init Session:0x7fe726bf1700 @v_node0001: {SessionRun} 08006/4777: SSL initialization failure

    SruthiA
    Forum|alt.badge.img+1
    • SruthiA
    • Participating Frequently
    • November 1, 2019

    Since you mentioned that are trying for mutual mode, you need to set SSLCA parameter as well, can you share me the output of the following

    select ssl_state from sessions;

    kontactmaneesh
    • kontactmaneesh
    • Author
    • Participating Frequently
    • November 2, 2019

    Thanks a lot for your reply .
    I am sharing command detail .
    dbadmin=> select ssl_state from sessions;

    ssl_state

    None
    None
    None
    None
    None
    (5 rows)
    Kindly help me how should I proceed?
    Even, I checked that SSL certificate, SSL private key & SSL enable and all are coming as per expectations .
    Checked with help of below command.
    select parameter_name, current_value, default_value from vs_configuration_parameters where parameter_name in ('EnableSSL','SSLCertificate', 'SSLPrivateKey');"

    kontactmaneesh
    • kontactmaneesh
    • Author
    • Participating Frequently
    • November 2, 2019

    I observed that it's started work but the solution is very strange.
    I changed to root.crt certificate name to roor.crt certificate name in /home/dbadmin/vsql dirctory and it's worked.
    could you please let me know why is it?

    SruthiA
    Forum|alt.badge.img+1
    • SruthiA
    • Participating Frequently
    • November 2, 2019

    Glad to know it is working. Reviewing logs will help us to understand root cause of the issue as in why it was not working earlier.

    Still scrolling?
    Ask a question
    Terms & ConditionsAccessibility statement