With a tls enabled cluster got bad certificate error
Open
Nobody has claimed this yet.
type/bug
- Dominant language
- Go
- Stars
- 466
- Forks
- 338
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 8
Description
Bug Report
With a tls enabled cluster
tiup cluster display command show cdc status abnormal and use cdc cli would got bad certificate error.
Please answer these questions before submitting your issue. Thanks!
- What did you do?
tiup cluster deploy test v5.2.2 test.yaml ## with cdc server
tiup cluster tls test enable
tiup cluster upgrade test v5.3.0
tiup cluster display test
tiup cdc cli changefeed list --pd=http://xxx.xxx.xxx.xxx:2879 --ca /root/.tiup/storage/cluster/clusters/test/tls/ca.crt --cert /root/.tiup/storage/cluster/clusters/test/tls/client.crt --key /root/.tiup/storage/cluster/clusters/test/tls/client.pem
- What did you expect to see?
tiup cluster display test
ID Role Host Ports OS/Arch Status Data Dir Deploy Dir
-- ---- ---- ----- ------- ------ -------- ----------
xxx.xxx.xxx.xxx:8300 cdc 172.16.5.83 8300 linux/x86_64 Up /data2/tidb-data/cdc-8300 /data2/tidb-deploy/cdc-8300
- What did you see instead?
tiup cluster display test
ID Role Host Ports OS/Arch Status Data Dir Deploy Dir
-- ---- ---- ----- ------- ------ -------- ----------
xxx.xxx.xxx.xxx:8300 cdc 172.16.5.83 8300 linux/x86_64 Down /data2/tidb-data/cdc-8300 /data2/tidb-deploy/cdc-8300
tiup cdc cli changefeed list --pd=http://xxx.xxx.xxx.xxx:2879 --ca /root/.tiup/storage/cluster/clusters/test/tls/ca.crt --cert /root/.tiup/storage/cluster/clusters/test/tls/client.crt --key /root/.tiup/storage/cluster/clusters/test/tls/client.pem
[2022/08/04 17:43:00.023 +08:00] [WARN] [cli_changefeed_list.go:103] ["query changefeed info failed"] [error="Post \"https://xxx.xxx.xxx.xxx:8300/capture/owner/changefeed/query\": remote error: tls: bad certificate"]
- What version of TiUP are you using (
tiup --version)?
v1.10.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the listed tiup cluster deploy, tls enable, upgrade, display, and tiup cdc cli commands using TiUP v1.10.2. Trace the TLS handling behind the cluster display and CDC CLI entry points. Done means the CDC reports Up in tiup cluster display and the CLI no longer returns a TLS bad certificate error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100