Replace gen_certs.sh with rust #1111
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rukai
force-pushed
the
fix_cassandra_cert_gen
branch
2 times, most recently
from
08ea992
to
23deca9
Compare
rukai
force-pushed
the
fix_cassandra_cert_gen
branch
from
23deca9
to
ca27f1e
Compare
conorbros
approved these changes
Apr 2, 2023
|
The datastax TLS tests have been failing on main for me so I've been unable to test them :/ |
|
Welcome to the wild world of openssl compatibility |
benbromhead
approved these changes
Apr 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
supercedes #1110
Completely replaces cassandra gen_certs.sh with the same logic used for generating redis certs + extra 1 openssl command to generate the p12 file.
I've renamed all the generated certs from
redis->localhostso we dont have cassandra certs named redis :PThere was a stray
generate_cassandra_test_certs();that was causing issues because it was regenerating the certs mid test run so I removed it.Motivation
The certificate generated by gen_certs.sh is not a valid x509 v3 cert (its probably v1 or v2), although I think the ca cert is v3.
This is causing issues with rustls which accepts only x509 v3 rejecting v1/v2.
Trying to figure out what magic flags and settings I need to give openssl to make the cert v3 proved impossible for me.
So instead I opted to just reuse what we already have for redis + keep the p12 generation command which is working fine.
I've verified that this change fixes the issue I was hitting with rustls.