Fail to verify SSL identity when recursing into a host with a different SSL cert
- Dominant language
- Go
- Stars
- 13.6k
- Forks
- 1.4k
- Avg merge
- 2h 31m
- Merged PRs (30d)
- 4
Description
Here when gh-ost is recursively finding masters:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/utils.go#L131
It copies the entire `connectionConfig`, including the private `tlsConfig` field:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/connection.go#L49
without updating its hostname:
https://github.com/github/gh-ost/blob/b7db8c6ca76712ae28bd97ca0f1c29fd152228cd/go/mysql/connection.go#L98
Hence, it tries to connect to a new host likely with a different hostname and certificate, but still asks x509 to verify against the old hostname, which always fails:
> x509: certificate is valid for [old hostname], not [newly found hostname]
Contributor guide
Assessment
This issue has not been assessed yet.