ClickHouse / ClickHouse/ClickHouse

Adding TLS/openssl config to running clickhouse server causes configuration error

Open
#65,955 0 comments 3 reactions 0 assignees View on GitHub
comp-config external unfinished code usability
Dominant language
C++
Stars
49.9k
Forks
9k
Avg merge
21h 32m
Merged PRs (30d)
515

Description

**Describe what's wrong**

When adding TLS configuration while clickhouse is running with only plaintext configuration, I get an error from the ConfigReloader as seen below, and clickhouse won't listen on the TLS ports. If I restart clickhouse, the config is loaded fine, clickhouse listens on the TLS ports, and there are no errors. Is it expected behavior that clickhouse is unable to start listening to TLS ports without a restart after adding TLS configuration?

**Does it reproduce on the most recent release?**

It reproduces on 24.1.5.6 and 24.6.1.4423.

**How to reproduce**

* Start clickhouse (i'm running in docker) with default configuration
* Create private key / certificate / truststores in pem format on disk
* Add TLS configuration to config.d. I'm using this configuration:
```xml




10443
9440
9010


/etc/clickhouse-server/certs/node.crt
/etc/clickhouse-server/certs/node.key
/etc/clickhouse-server/certs/truststore.crt
true
true


/etc/clickhouse-server/certs/node.crt
false
/etc/clickhouse-server/certs/truststore.crt
true
none

```

**Expected behavior**

> Clickhouse should listen on TLS ports without errors.

**Error message and/or stacktrace**

```
ConfigReloader: Error updating configuration from '/etc/clickhouse-server/config.xml' config.: Code: 210. DB::Exception: Listen [0.0.0.0]:10443 failed: Poco::Exception. Code: 1000, e.code() = 0, SSL Exception: Configuration error: no certificate file has been specified (version 24.6.1.4423 (official build)). (NETWORK_ERROR), Stack trace (when copying this message, always include the lines below):

0. DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x000000000c347c68
1. DB::Exception::Exception(PreformattedMessage&&, int) @ 0x0000000007b9a33c
2. DB::Exception::Exception(int, FormatStringHelperImpl::type, std::type_identity::type, std::type_identity::type>, String const&, int&, String&&) @ 0x000000000c3d4d40
3. DB::Server::createServer(Poco::Util::AbstractConfiguration&, String const&, char const*, bool, bool, std::vector>&, std::function&&) const @ 0x000000000c49d538
4. DB::Server::createServers(Poco::Util::AbstractConfiguration&, std::vector> const&, bool, Poco::ThreadPool&, DB::AsynchronousMetrics&, std::vector>&, bool, DB::ServerType const&) @ 0x000000000c4b8aa0
5. DB::Server::main(std::vector> const&)::$_6::operator()(Poco::AutoPtr, bool) const @ 0x000000000c4ca794
6. void std::__function::__policy_invoker, bool)>::__call_impl> const&)::$_6, void (Poco::AutoPtr, bool)>>(std::__function::__policy_storage const*, Poco::AutoPtr&&, bool) @ 0x000000000c4c6cb4
7. DB::ConfigReloader::reloadIfNewer(bool, bool, bool, bool) @ 0x00000000118a2054
8. DB::ConfigReloader::run() @ 0x00000000118a2f60
9. void std::__function::__policy_invoker::__call_impl::ThreadFromGlobalPoolImpl(void (DB::ConfigReloader::*&&)(), DB::ConfigReloader*&&)::'lambda'(), void ()>>(std::__function::__policy_storage const*) @ 0x00000000118a3be0
10. void* std::__thread_proxy[abi:v15000]>, void ThreadPoolImpl::scheduleImpl(std::function, Priority, std::optional, bool)::'lambda0'()>>(void*) @ 0x000000000c3ec2c0
11. start_thread @ 0x0000000000007624
12. ? @ 0x00000000000d162c
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.