TLS negotiation failure with rustls against ES 7.1.0

[dcarosone]

I'm using 0.21.pre4 against ES 7.1.0. TLS negotiation fails with 'no cipher suites in common'.

Looking at docs, the default cipher set for Java/elastic, even with the 'stronger' crypto modules enabled, don't include any GCM modes, mostly various bit-lengths of AES CBC modes. Meanwhile, rustls only includes ciphers with PFS, so there's nothing in common. Notionally I can add those to ES by editing config and digging through ES and Oracle doc links to find magic strings.

But the net result is that the elastic crate in default config won't talk to elasticsearch in default config with TLS, and that's probably not desirable as much as we'd prefer to have stronger ciphers used.

Workaround is instead to pull in reqwest directly in my own Cargo.toml to add back the default feature, so it links against native-tls (openssl) again.

Related to #341 and #336

[KodrAus]

Thanks for the report @dcarosone

This is unfortunate. I think we could look at mirroring reqwest's TLS features, so you opt-in to either openssl or rustls:

[dependencies.reqwest]
default-features = false

[features]
rustls-tls = [
    "reqwest/rustls-tls"
]

default-tls = [
    "reqwest/default-tls"
]

That way you could pick the implementation to use.

What do you think?

[dcarosone]

That seems fine, and a simple enough way to avoid cargo tricks and/or risk pulling in multiple versions.

Also worth noting (in doc for those options) that, for rustls, if you're using an internal CA you'll need to add the trust manually. I did this, which you're welcome to take for an example:

let http_client = reqwest::ClientBuilder::new()
    .add_root_certificate(
        reqwest::Certificate::from_pem(include_bytes!("../My-Internal-CA.pem")).unwrap(),
    )
    .build()
    .unwrap();

let client = SyncClientBuilder::new()
    .static_node("https://my-es-ingest-node:9200")
    .http_client(http_client)
    .params_fluent(|p| { ... }
    .build()
    .unwrap();

.. but that became irrelevant (or at least unnecessary) when I had to switch back to openssl, because the cert is installed in the OS trust store.