-
Notifications
You must be signed in to change notification settings - Fork 29
Credhub login failure related to CA certs #97
Comments
Found similar issue is reported in |
Hello @sureshgoli25 , |
Hi @sureshgoli25 , |
@sureshgoli25 That error isn't the result of the CA being invalid. Instead it appears that the certificate on the credhub is missing your domain from its CN and/or SANs. You can check what names are in your certificate with We generate that certificate with BOSH here so provided you are passing the |
@crsimmons here is the output curl https://ci.ap.innogy.com:8844
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
suresh $ curl https://ci.ap.innogy.com:8844 -k
{"error":"invalid_token","error_description":"Full authentication is required to access this resource"}suresh $
suresh $
suresh $ clear
suresh $ openssl s_client -connect ci.ap.innogy.com:8844
CONNECTED(00000003)
depth=0 C = USA, O = Cloud Foundry, CN = 18.184.118.127
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = USA, O = Cloud Foundry, CN = 18.184.118.127
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=USA/O=Cloud Foundry/CN=18.184.118.127
i:/C=USA/O=Cloud Foundry/CN=ConcourseCA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDUjCCAjqgAwIBAgIRAKCFmxINV2S6gMOfeKVtBBgwDQYJKoZIhvcNAQELBQAw
PDEMMAoGA1UEBhMDVVNBMRYwFAYDVQQKEw1DbG91ZCBGb3VuZHJ5MRQwEgYDVQQD
EwtDb25jb3Vyc2VDQTAeFw0xOTAyMjExMjU5NTBaFw0yMDAyMjExMjU5NTBaMD8x
DDAKBgNVBAYTA1VTQTEWMBQGA1UEChMNQ2xvdWQgRm91bmRyeTEXMBUGA1UEAxMO
MTguMTg0LjExOC4xMjcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/
j/QQT95H7ZS5LvFMJpqqT9mubchLc15G05x8L9YaM3/SjCOeDIMusQKeHzWSAp/l
omCtcZ0LC34QMwv2Flgwhn2gq0rmg1vcycH+0xMNIMaTVfX8rUAcNzgImDir94lw
JUVSYWWGnG7KovIIxzPgIILRkAjRZmgd0SqrGTGLtp70IfGuSMyll6JVw2+x/t10
7AR8D6t4/aVIO7+q4bNL19EuK3hq+incAplRsUV4zCID9OBVAzOk2lnekNyuhmrQ
VTT14fLYMPN2A0hQQc5hD8riueb6sxxmKBvbDXb55smlaT34aa3XBp7qZZtAFWOV
MksnPAAydIg6slIw7tglAgMBAAGjTDBKMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE
DDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMBUGA1UdEQQOMAyHBBK4dn+HBH8A
AAEwDQYJKoZIhvcNAQELBQADggEBAC386Pt6yE9CAImD3CjJPXq3xhCA3g4YpdZ4
7GhehZL5B3KT5PI2gbuMdNjxboNzW8St7KKzjKKINsMt9lw48qh+0YYpfCrHwBcf
BnqgF6hiq3g2Ia1BSz1apepjCVYOEVWuq8aWMQv2QLzzuet9DZL3tj517IFNgc90
bMikoGFZkHOcxx6SYvffxJgnTXfgt5xY5WtyJJGtNwToqrpvyk+DjVpx36C9Tg/s
Ptu0fkytkUJRjNqAgQF5RRHzCIGJgSwn2vbE1QbZlWFGQHTvQ2w1ua7DwESxpwLl
3KvI4OdWGJXXozWCkjiA77WceFuVR2+d0hwbtWTpLU0zxuhtBe8=
-----END CERTIFICATE-----
subject=/C=USA/O=Cloud Foundry/CN=18.184.118.127
issuer=/C=USA/O=Cloud Foundry/CN=ConcourseCA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 4096 bits
---
SSL handshake has read 2300 bytes and written 879 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES128-GCM-SHA256
Session-ID: 5C6FB68830033281139B441DC042487DA0E0F2B5A5332F0DAD0545339FE4E4F6
Session-ID-ctx:
Master-Key: C6D0894B2734AEA4FE9E0961D7E114353EC5169BCC3DD39C6D26F065F9F257BFA9D5DE2884B100FB2A81A46CC1350C21
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1550825096
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
--- |
@crsimmons @evadinckel Also i would see that the certificate which is generated is valid for only 3 months. I would assume this certificate will be auto-renewed before expiry. Is my assumption is correct? |
The certificate is using the EIP of the web vm as the common name. This suggests the |
In config.json it showing "domain":"ci.ap.innogy.com" |
Sorry for the delay. We had some unrelated issues on our end. I'm not sure why the CN is showing as the EIP. We just tried What command did you use to deploy originally? We will try to reproduce it on Monday. |
After speaking with @sureshgoli25 elsewhere we have established that this problem resulted from:
This happens because that certificate is generated by BOSH then is stored in the Using the ATC IP instead of the domain in the A manual solution is to download |
Hi everyone, jumping back to this conversation: Hello @sureshgoli25, |
I am trying to connect to Credhub and seem to get an error around the CA cert being invalid.
credhub api Error connecting to the targeted API: "Get https://<domain name>>:8844/info: x509: certificate is not valid for any names, but wanted to match <<domain name>>". Please validate your target and retry your request.
if use --skip-tls-validation, i am able to login
credhub api --skip-tls-validation Setting the target url: https://ci.ap.innogy.com:8844/ Warning: The targeted TLS certificate has not been verified for this connection. Warning: The --skip-tls-validation flag is deprecated. Please use --ca-cert instead.
This is after exporting all the env vars and they are there. Is there something else to do with this certificate?
While trying to setting-up the credstore values, i am getting below error.
Anyway to resolve it quickly.
The text was updated successfully, but these errors were encountered: