hasura / hasura/graphql-engine

SSL for self signed on prem env error.

Open
#10,645 1 comment 1 reaction 0 assignees View on GitHub
c/v2-engine engine k/bug v2 v2-engine
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

latest v2.45.1

### Environment

on-prem on openshift.

### What is the current behaviour?

When creating event and triggering it the response is as following:
\"Internal error: HandshakeFailed (Error_protocol \\\"certificate rejected: [InvalidSignature SignatreInvalid]\\\" CertificateUnknown)
"type": "client_error",
"version": "2"

When doing curl in the pod itself.
`curl --capath /etc/ssl/certs` or `curl --cafile ` it also works, also `openssl s_client :443 -CAfile `.

### What is the expected behaviour?

The event to work and trigger creating a PUT request to the webhook.

### How to reproduce the issue?

1. Create a webhook in an on-prem self signed env.
2. Create the event
3. Trigger it.

### Any possible solutions/workarounds you're aware of?

I have tried the following:
(all operations i have used a bundle of ca certs that works in all of our env.)
Mounting to /etc/ssl/certs
Mounting to /etc/ssl/certs/ca-certificates.crt
Using TLS allow list in UI
Using tls verify false in env
Using `HASURA_GRAPHQL_CERTIFICATE_AUTHORITY=/certs/mycrt.crt`

Contributor guide

Open the contributing guide

Research direction

Reproduce the webhook event in the on-prem OpenShift environment and compare it with curl and openssl using the same CA bundle. Trace TLS certificate handling for webhook PUT requests; done means a self-signed certificate trusted by that bundle no longer yields InvalidSignature or CertificateUnknown and the event triggers.

Written by the indexing model from the issue text.

Assessment

Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.