x509: cannot validate certificate for <ipaddress> because it doesn't contain any IP SANs

[gregorygtseng]

I have a use case where I am scraping hosts via IP, but they serve a valid SSL cert. I don't want to use the insecure_skip_verify option in <tls_config>. What options do I have?

[pdbogen]

Technically, this is not a valid SSL cert, because it doesn't match the name (in this case, IP) being used to connect.

You have three options:

• Connect by name (either implement DNS, or if your environment is very static, add the hostnames to /etc/hosts on the prometheus server)
• Set insecure_skip_verify
• Reissue the certs to include an IP SAN for the host's IP

[gregorygtseng]

So 'valid SSL cert' means it has a complete chain of trust to a root CA. IF there was a proper DNS entry, this would be a non-issue. However these are dynamic environments ( autoscaling / spot instances ), so I do not want to manage an ever changing list of DNS entries or host entries.

I already specified that I don't want to disable verification completely.
Since the host IPs will change, I don't think the IP SAN is a valid option.

There is another option: specify ServerName in prometheus scraper client to match the certificate provided by these hosts.

[pdbogen]

The chain of trust is only one aspect of the validity of a certificate. What you're running into- effectively a name mismatch (you call it 1.2.3.4, the cert says it's valid for some.host.example.com)- is another very important validity check.

You're right that providing an alternative expected hostname to the SSL verification routine would fix this issue. Hopefully the devs will implement this for you.

[gregorygtseng]

@pdbogen Thanks for your comments and discussion. I went ahead and created #1658

[gregorygtseng]

Implemented in #1658

[vhosakot]

I saw the same error when using mysql client in golang:

Failed to connect to database:  x509: cannot validate certificate for 10.111.202.229 because it doesn't contain any IP SANs

and setting InsecureSkipVerify to true (to skip verification of certificate) resolved it for me:

https://godoc.org/crypto/tls#Config