request help: etcd TLS

[Uangski]

你好，我有 etcd集群，设置了 tls 方式连接，有 ca-file、key-file 以及 cert-file 三个文件，如何配置 apisix .conf 呢？
模板里是这么配置的
etcd:
host:

• "https://admin.apisix.dev:22379"
  prefix: "/apisix"
  tls:
  cert: t/certs/mtls_client.crt
  key: t/certs/mtls_client.key

模板里只有 cert和key 。没有ca选项，最终连接不了 etcd集群。请问下我这种情况，该如何配置呢？

Issue description

Environment

Request help without environment information will be ignored or closed.

• apisix version (cmd: apisix version):
• OS (cmd: uname -a):
• OpenResty / Nginx version (cmd: nginx -V or openresty -V):
• etcd version, if have (cmd: run curl http://127.0.0.1:9090/v1/server_info to get the info from server-info API):
• apisix-dashboard version, if have:
• luarocks version, if the issue is about installation (cmd: luarocks --version):

[tokers]

@Uangski You should set ssl_trusted_certificates item, see https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L116 for the details.

[Uangski]

设置相关参数，如下：
ssl_trusted_certificate: "/opt/etcd/ssl/ca.pem"
tls:
key: "/opt/etcd/ssl/client-key.pem"
cert: "/opt/etcd/ssl/client.pem"
verify: true
日志报错：
2021/05/27 10:09:13 [error] 44#44: *16 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer
2021/05/27 10:09:13 [error] 44#44: *24 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer
2021/05/27 10:09:13 [error] 45#45: *34 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer
2021/05/27 10:09:13 [error] 45#45: *49 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer
请问有可能是哪里出问题了呢？用 etcdctl --endpoints="https://192.168.58.128:2379" --cacert="/opt/etcd/ssl/ca.pem" --key="/opt/etcd/ssl/client-key.pem" --cert="/opt/etcd/ssl/client.pem" get /apisix/plugins 是可以返回内容的。

[tokers]

@Uangski See https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L210, you should use the OpenResty for APISIX.

[spacewander]

Closed as lack of response.

[waringid]

设置相关参数，如下： ssl_trusted_certificate: "/opt/etcd/ssl/ca.pem" tls: key: "/opt/etcd/ssl/client-key.pem" cert: "/opt/etcd/ssl/client.pem" verify: true 日志报错： 2021/05/27 10:09:13 [error] 44#44: *16 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer 2021/05/27 10:09:13 [error] 44#44: *24 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer 2021/05/27 10:09:13 [error] 45#45: *34 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer 2021/05/27 10:09:13 [error] 45#45: *49 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42), context: ngx.timer 请问有可能是哪里出问题了呢？用 etcdctl --endpoints="https://192.168.58.128:2379" --cacert="/opt/etcd/ssl/ca.pem" --key="/opt/etcd/ssl/client-key.pem" --cert="/opt/etcd/ssl/client.pem" get /apisix/plugins 是可以返回内容的。

这个问题解决了吗？我也遇到同样的情况。