hashicorp / hashicorp/consul-template

TLS validation error since v 0.19.4 on Alpine Linux 3.6

Open
#1,041 1 comment 0 reactions 0 assignees View on GitHub
upstream
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

### Consul Template version

0.19.4

### Command

```shell
consul-template -once -consul-addr 172.30.0.1:8501 -consul-ssl -consul-ssl-ca-cert /etc/consul.d/ssl/ca.pem -consul-ssl-cert /etc/consul.d/ssl/client.pem -consul-ssl-key /etc/consul.d/ssl/client-priv-key.pem -consul-ssl-server-name server.local.my.domain
```

### Debug output

```
2017/11/06 11:08:41.316026 [ERR] (cli) kv.get(config/value): Get https://172.30.0.1:8501/v1/kv/config/value?stale=&wait=60000ms: x509: certificate is not valid for any names, but wanted to match server.local.my.domain
```
```
openssl s_client -connect 172.30.0.1:8501 -verify 3 -CAfile /etc/consul.d/ssl/ca.pem -cert /etc/consul.d/ssl/client.pem -key /etc/consul.d/ssl/client-priv-key.pem
```
```
Timeout : 300 (sec)
Verify return code: 0 (ok)
```

### Expected behavior

TLS validation success

### Actual behavior

TLS validation failed

Using consul-template 0.19.3, valiation is working well.

### References

I have the same problem with server connections (RPC) since consul 1.0.0 https://github.com/hashicorp/consul/issues/3613

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the TLS validation failure with the shown consul-template command on Alpine Linux 3.6, then compare behavior between versions 0.19.3 and 0.19.4. Read the linked Consul issue about the corresponding RPC problem; done means the supplied certificates validate successfully with 0.19.4.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.