hashicorp / hashicorp/consul-template
TLS validation error since v 0.19.4 on Alpine Linux 3.6
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
### Consul Template version
0.19.4
### Command
```shell
consul-template -once -consul-addr 172.30.0.1:8501 -consul-ssl -consul-ssl-ca-cert /etc/consul.d/ssl/ca.pem -consul-ssl-cert /etc/consul.d/ssl/client.pem -consul-ssl-key /etc/consul.d/ssl/client-priv-key.pem -consul-ssl-server-name server.local.my.domain
```
### Debug output
```
2017/11/06 11:08:41.316026 [ERR] (cli) kv.get(config/value): Get https://172.30.0.1:8501/v1/kv/config/value?stale=&wait=60000ms: x509: certificate is not valid for any names, but wanted to match server.local.my.domain
```
```
openssl s_client -connect 172.30.0.1:8501 -verify 3 -CAfile /etc/consul.d/ssl/ca.pem -cert /etc/consul.d/ssl/client.pem -key /etc/consul.d/ssl/client-priv-key.pem
```
```
Timeout : 300 (sec)
Verify return code: 0 (ok)
```
### Expected behavior
TLS validation success
### Actual behavior
TLS validation failed
Using consul-template 0.19.3, valiation is working well.
### References
I have the same problem with server connections (RPC) since consul 1.0.0 https://github.com/hashicorp/consul/issues/3613
Contributor guide
Research direction
Start by reproducing the TLS validation failure with the shown consul-template command on Alpine Linux 3.6, then compare behavior between versions 0.19.3 and 0.19.4. Read the linked Consul issue about the corresponding RPC problem; done means the supplied certificates validate successfully with 0.19.4.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100