Make certs work

[mberhault]

Priority:

• node-to-node certs (seems functional with self-signed certs)
• client-to-node certs (especially with self-signed certificates. currently broken)

Important:

• check tls settings. ciphers, versions, etc...

Secondary:

• self-signed cert deployment

[mberhault]

Done in "HTTPS everywhere" PR:

• https for everything
• server/client tls configs
• generate CA/node certs

Clients certs are not currently required.

[cockroach-team]

I don't know if this problem is related to this thread or not, but I just
updated my server code, and now I can't connect to the browser REST
interface because the cert seems "bad". Chrome is complaining the cert is
invalid (I.E won't work either). I did import the generated CA cert into
chrome, but that didn't seem to have any effect.

Any workaround for this problem? Is there a way to disable SSL in the
config, at least until the certs are fully functional?

Thanks.

On Wednesday, April 22, 2015 at 5:01:39 AM UTC-7, MBerhault wrote:

Done in "HTTPS everywhere" PR:

• https for everything
• server/client tls configs
• generate CA/node certs

Clients certs are not currently required.

—
Reply to this email directly or view it on GitHub
#685 (comment)
.

[mberhault]

yes, the self-signed CA needs to be added to chrome.
I did the following:
chrome -> settings -> "show advanced" -> "HTTPS/SSL" Manage certificates -> "Authorities" -> import -> select the generated ca.crt -> open

That worked.
I did run into an issue with chrome saying its maximum TLS version was 1.0 (we have 1.1 for the minimum version on the server. I wanted 1.2, but circli curl was unhappy).
I changed the chrome "minimum SSL/TLS version" to 1.1 in chrome://flags/ and it worked. I flipped it back to default, and it's still working. This could be due to tls settings cache, but worth a try.

[cockroach-team]

I imported the self signed CA, but it still doesn't work. I closed and
restarted both browsers (IE. and chrome), and it doesn't work in either of
them.

FYI, I am running my server on a different machine than my client /
browser. I am not sure if that has anything to do with it.

My error is "NET::CERR_CERT_INVALID", and there is no option to continue /
ignore then error. It just won't connect. On the coachroach server, the log
says "TLS handshake error". I tried deleting and regenerating the certs,
but that doesn't make any difference.

On Wednesday, April 22, 2015 at 12:22:25 PM UTC-7, MBerhault wrote:

yes, the self-signed CA needs to be added to chrome.
I did the following:
chrome -> settings -> "show advanced" -> "HTTPS/SSL" Manage certificates
-> "Authorities" -> import -> select the generated ca.crt -> open

That worked.
I did run into an issue with chrome saying its maximum TLS version was 1.0
(we have 1.1 for the minimum version on the server. I wanted 1.2, but
circli curl was unhappy).
I changed the chrome "minimum SSL/TLS version" to 1.1 in chrome://flags/
and it worked. I flipped it back to default, and it's still working. This
could be due to tls settings cache, but worth a try.

—
Reply to this email directly or view it on GitHub
#685 (comment)
.

[mberhault]

This is most likely one of two things:

• the CA cert is not properly loaded in chrome (probably not since you added it)
• the hostname does not match (it's fine for the cockroach cli since we currently InsecureSkipVerify:true, but I doubt chrome is ok with that). You need to make sure that the hostname used to connect to the server is specified on the "./cockroach create-node-cert ..." command line. We always put localhost and 127.0.0.1, and the server requires $(hostname), but if that differs from the externally-accessible name/ip, you'll need to add it as well.

[cockroach-team]

I have tried every which way, but I just can't seem to get the certs to
work. Chrome, IE etc all complain, and I tested with openssl from my
windows box, and always seem to get an error 21. I did also set up my hosts
file on my windows machine to make sure I was using the same hostname that
is set in the cert. However, nothing seems to fix the problem.

Is there any way to disable SSL and just use standard HTTP?

Thanks.

On Wednesday, April 22, 2015 at 1:41:51 PM UTC-7, MBerhault wrote:

This is most likely one of two things:

• the CA cert is not properly loaded in chrome (probably not since you
  added it)
• the hostname does not match (it's fine for the cockroach cli since
  we currently InsecureSkipVerify:true, but I doubt chrome is ok with that).
  You need to make sure that the hostname used to connect to the server is
  specified on the "./cockroach create-node-cert ..." command line. We always
  put localhost and 127.0.0.1, and the server requires $(hostname), but if
  that differs from the externally-accessible name/ip, you'll need to add it
  as well.

—
Reply to this email directly or view it on GitHub
#685 (comment)
.

[cockroach-team]

I tested with a custom generated CA and cert (which I generated with
openSSL). This somewhat works in that it allows the REST explorer page to
load in Chrome, and I can get the openssl client to connect with no error
from my windows box (by specifying which CA to use for validating the
server cert).

However, the problem after that is that I can't issue any RPC commands. The
server log shows a TLS error. Same problem occurs when I try connecting
from my Java client (with the CA imported into the cacerts file).

Log shows:

I0423 00:11:24.859383 783 server.go:1775] http: TLS handshake error
from 192.168.1.238:40330: tls: client's certificate's extended key usage
doesn't permit it to be used for client authentication

I am not sure why the default certs generated by cockroachdb won't work. I
re-generated the certs via cockroachdb many times, and those just won't
work in any way.

On Wednesday, April 22, 2015 at 9:18:52 PM UTC-7, YN wrote:

I have tried every which way, but I just can't seem to get the certs to
work. Chrome, IE etc all complain, and I tested with openssl from my
windows box, and always seem to get an error 21. I did also set up my hosts
file on my windows machine to make sure I was using the same hostname that
is set in the cert. However, nothing seems to fix the problem.

Is there any way to disable SSL and just use standard HTTP?

Thanks.

On Wednesday, April 22, 2015 at 1:41:51 PM UTC-7, MBerhault wrote:

This is most likely one of two things:

• the CA cert is not properly loaded in chrome (probably not since
  you added it)
• the hostname does not match (it's fine for the cockroach cli since
  we currently InsecureSkipVerify:true, but I doubt chrome is ok with that).
  You need to make sure that the hostname used to connect to the server is
  specified on the "./cockroach create-node-cert ..." command line. We always
  put localhost and 127.0.0.1, and the server requires $(hostname), but if
  that differs from the externally-accessible name/ip, you'll need to add it
  as well.

—
Reply to this email directly or view it on GitHub
#685 (comment)
.

[mberhault]

disabling ssl: it's currently not doable. I still have some refactoring to do which may make it much simpler, but I'm not sure this is ever something we'll want. The right solution is to make the setup and use with ssl as painless as possible. clearly, I still have some work to do.

Java client: can you point me to it? I'd be happy to take a look. It could simply be default TLS options (eg: we want the java equivalent of Go's tls.Config.InsecureSkipVerify)

SSL error: the certificate you're using cannot be used for client authentication. It needs the ExtKeyUsageClientAuth field (http://golang.org/pkg/crypto/x509/#ExtKeyUsage). In the Go code, only the rpc client loads client certs (they are combined client/server certs). The non-node clients (rest/json) do not load client certs, just the CA.

Could you try a simple local single node setup (same machine), there are too many variables here to debug.
Here's what I'm doing with a build from HEAD. The cert/init/start steps are straight out of the readme.

DIR=$(mktemp -d /tmp/dbXXX)
# Initialize CA and server certificates. Default directory is -certs=certs
./cockroach create-ca-cert
./cockroach create-node-cert 127.0.0.1 localhost $(hostname)
# Initialize data directories.
./cockroach init $DIR
# Start the server.
./cockroach start -stores ssd="$DIR" -gossip self:// &

# All this starts a single-node server on my local machine with certs in the default location:$(PWD)/certs/
# From the same directory, I can now issue basic commands (again, -certs defaults to certs/)
./cockroach put a 1 b 2
./cockroach scan
"a" 1
"b" 2

Now for the status page. Just going to https://localhost:8080 in chrome (Version 42.0.2311.90 (64-bit)) gives me a certificate invalid error. I add the generated certs/ca.crt to chrome's list of authorities and fetching https://localhost:8080 now works.