cockroachdb / cockroachdb/docs

Change to certificate auth in v21.2.0 could use some documentation

Open
#12,448 3 comments 0 reactions 1 assignee Claimed by @rmloveland View on GitHub
Dominant language
HTML
Stars
212
Forks
476
Avg merge
40m
Merged PRs (30d)
3

Description

Exalate commented:

**Describe the problem**

A [PR](https://github.com/cockroachdb/cockroach/issues/71102) was merged and released in CRDB v21.2.0 that added a check to the client cert authentication that ensured that the CN matches the username of the user we are authenticating as. It would be good to document this change in the release notes for 21.2.0 for others who may encounter this change.

**To Reproduce**

While less than stellar, we had a cron job that was using the node certificate bundle to authenticate as the root user. While this isn't optimal, upgrading our clusters to 21.2.0 suddenly broke our job. After some research, we found that the PR for issue 711202 changed the check, and switching to use the root user cert package instead resolved the issue.

**Expected behavior**
The change to validate the CN of the certificate bundle against the username should be documented for anyone who might encounter this in the future.

**Additional data / screenshots**
If the problem is SQL-related, include a copy of the SQL query and the schema
of the supporting tables.

If a node in your cluster encountered a fatal error, supply the contents of the
log directories (at minimum of the affected node(s), but preferably all nodes).

Note that log files can contain confidential information. Please continue
creating this issue, but contact support@cockroachlabs.com to submit the log
files in private.

If applicable, add screenshots to help explain your problem.

**Environment:**
- CockroachDB version 21.1.9 upgraded to 21.2.0
- Server OS: Linux
- Client App: JDBC

**Additional context**
A cron job using the node certificate bundle to authenticate as root failed to authenticate suddenly after the upgrade to v21.2.0

***
If you all welcome outside PRs to documentation, simply point me in the right direction and I am happy to give it a shot :D
***

Jira Issue: DOC-1862

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.