Skip to content

Confusing Error when using untrusted private CA #235

Open
@ylorph

Description

@ylorph

Describe the bug
Error Message is confusing when the private CA is not trusted & using discovery or gossip seed
with a connection like esdb+discover://[SomeDomain]:2113 or esdb://[node1]:2113,[node2]:2113,[node3]:2113
It says Failed to discover candidate in 10 attempts.
while actually the certificate chain is not trusted

To Reproduce
Steps to reproduce the behavior:

  1. create a 3 node cluster with a private CA
  2. do NOT trust the root ca
  3. append / read an event with the C# client

Expected behavior
An error message telling the problem is that the certificate presented by the node is not trusted .
and that either the root CA should be added to the trusted store certificates or tlsVerifyCert=false added to the connection string

  • some details about the problematic certificate

Actual behavior
Error message is

Unhandled exception. EventStore.Client.DiscoveryException: Failed to discover candidate in 10 attempts.
at EventStore.Client.GossipChannelSelector.DiscoverAsync(CancellationToken cancellationToken)
at EventStore.Client.GossipChannelSelector.SelectChannelAsync(CancellationToken cancellationToken)`

That error is confusing , as the first reason that would pop into one's mind is that the discovery failed due to some network problem or the cluster being down .

Config/Logs/Screenshots

EventStore details

  • EventStore server version: 22.10.0

  • Operating system: WIN 111

  • EventStore client version (if applicable): 22.0.0

Additional context
the error goes away when using esdb+discover://[SomeDomain]:2113?tlsVerifyCert=false but I wouldn't recommend that in a production scenario.
The client should be explicit about the problem to help diagnose & eventually give tips on how to solve

I guess this would be true for any root or certificate in the chain that would not be trusted.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions