github / github/gh-ost

Fail to verify SSL identity when recursing into a host with a different SSL cert

Open
#1,259 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
13.6k
Forks
1.4k
Avg merge
2h 31m
Merged PRs (30d)
4

Description

Here when gh-ost is recursively finding masters:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/utils.go#L131

It copies the entire `connectionConfig`, including the private `tlsConfig` field:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/connection.go#L49

without updating its hostname:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/connection.go#L98

Hence, it tries to connect to a new host likely with a different hostname and certificate, but still asks x509 to verify against the old hostname, which always fails:
> x509: certificate is valid for [old hostname], not [newly found hostname]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.