cockroachdb / cockroachdb/cockroach

The PostgreSQL 42.6.0 driver does not support ECDSA (Elliptic Curve Digital Signature Algorithm)

Open
#132,758 3 comments 0 reactions 0 assignees View on GitHub
A-docs branch-master C-bug O-community P-3 T-product-security
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

I encountered an issue where Go (and CockroachDB) works fine with any kind of certificates, but when trying to connect a 3rd party application (JetBrains), I ran into cryptography problems.

**To Reproduce**

I followed the instructions from the [CockroachDB documentation](https://www.cockroachlabs.com/docs/stable/intellij-idea), but it didn't work as expected. Six hours later, I discovered it was a PostgreSQL driver issue (version 42.2 to 42.6, I haven’t tested earlier versions). Through experimentation, I found that the driver only works with RSA cryptography.

**Expected behavior**

It would be helpful if this was mentioned in the documentation.

**Environment:**
- CockroachDB version v23.1.28
- Server OS: Docker
- Client app: intellij-idea

---

**Also there are questions about cryptography that I haven't found in the documentation:**
1. Is it possible to update the certificate without restarting the node (especially for the CA)?
2. How can I disable TLS for the webserver (port 8080) without disabling TLS for everything else?
3. How can I run the node without a webserver, just as part of a cluster?

Jira issue: CRDB-43267

Epic CC-33751

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.