influxdata / influxdata/influx-cli

SSL/TLS Handshake timeout

Open
#354 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
75
Forks
22
PR merge metrics
No merged PRs in 30d

Description

I have an InfluxDB instance on a Windows machine and want to access it via influx CLI. The InfluxDB instance has TLS enabled with a certificate signed by a Certificate Authority. influx CLI doesn't seem to be able to verify. I get a timeout in the TLS handshake.

Some additional information: inspecting the traffic with wireshark, Apperently, I get a mismatch in TLS version that is used. Here it is said that Protocol TLSv1.3 is used. But the TLS Version says 1.2
```
No. Time Source Destination Protocol Length Info
14 0.025962 xxxxxxx xxxxxxx TLSv1.3 2643 Server Hello, Application Data, Application Data, Application Data, Application Data

Frame 14: 2643 bytes on wire (21144 bits), 2643 bytes captured (21144 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: xxxxxx, Dst: xxxxxxx
Transmission Control Protocol, Src Port: 8086, Dst Port: 64703, Seq: 100, Ack: 708, Len: 2599
Transport Layer Security
TLSv1.3 Record Layer: Handshake Protocol: Server Hello
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 223
Handshake Protocol: Server Hello
Handshake Type: Server Hello (2)
Length: 219
Version: TLS 1.2 (0x0303)
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Windows influx CLI connection to the TLS-enabled InfluxDB instance with the CA-signed certificate, then inspect the TLS handshake in Wireshark. Compare the reported protocol and record versions with the timeout and certificate-verification behavior. Done means the CLI can connect and verify the server successfully, but the issue does not identify a file or test to update.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.