hasura / hasura/graphql-engine
SSL for self signed on prem env error.
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
latest v2.45.1
### Environment
on-prem on openshift.
### What is the current behaviour?
When creating event and triggering it the response is as following:
\"Internal error: HandshakeFailed (Error_protocol \\\"certificate rejected: [InvalidSignature SignatreInvalid]\\\" CertificateUnknown)
"type": "client_error",
"version": "2"
When doing curl in the pod itself.
`curl --capath /etc/ssl/certs` or `curl --cafile ` it also works, also `openssl s_client :443 -CAfile `.
### What is the expected behaviour?
The event to work and trigger creating a PUT request to the webhook.
### How to reproduce the issue?
1. Create a webhook in an on-prem self signed env.
2. Create the event
3. Trigger it.
### Any possible solutions/workarounds you're aware of?
I have tried the following:
(all operations i have used a bundle of ca certs that works in all of our env.)
Mounting to /etc/ssl/certs
Mounting to /etc/ssl/certs/ca-certificates.crt
Using TLS allow list in UI
Using tls verify false in env
Using `HASURA_GRAPHQL_CERTIFICATE_AUTHORITY=/certs/mycrt.crt`
Contributor guide
Research direction
Reproduce the webhook event in the on-prem OpenShift environment and compare it with curl and openssl using the same CA bundle. Trace TLS certificate handling for webhook PUT requests; done means a self-signed certificate trusted by that bundle no longer yields InvalidSignature or CertificateUnknown and the event triggers.
Written by the indexing model from the issue text.
Assessment
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100