You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "lizhimins (via GitHub)" <gi...@apache.org> on 2024/03/11 05:59:24 UTC
[I] [Bug] Fix SSL negotiation error when C++ client enables SSL with a server certificate issued by a non-CA entity [rocketmq-clients]
lizhimins opened a new issue, #698:
URL: https://github.com/apache/rocketmq-clients/issues/698
### Before Creating the Bug Report
- [X] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq-clients/discussions).
- [X] I have searched the [GitHub Issues](https://github.com/apache/rocketmq-clients/issues) and [GitHub Discussions](https://github.com/apache/rocketmq-clients/discussions) of this repository and believe that this is not a duplicate.
- [X] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
### Programming Language of the Client
C++
### Runtime Platform Environment
This issue addresses the problem that arises when a C++ client with SSL enabled encounters an negotiation error due to the server certificate not being issued by a Certificate Authority (CA). The specific error message encountered is as follows:
D0309 13:35:25.012029070 1308 security_handshaker.cc:181] Security handshake failed:
{"created":"@1709962525.012016359","description":"Custom verification check failed with error: UNAUTHENTICATED: Hostname Verification Check failed.","file":"/home/terrance.lzm/grpc/grpc/src/core/lib/security/security_connector/tls/tls_security_connector.cc","file_line":502}
### RocketMQ Version of the Client/Server
RocketMQ C++ client 5.0.1 and Master branch of C++ version (2024.3.11)
### Run or Compiler Version
_No response_
### Describe the Bug
SSL negotiation error when C++ client enables SSL with a server certificate issued by a non-CA entity
### Steps to Reproduce
Run demo
### What Did You Expect to See?
SSL negotiation success
### What Did You See Instead?
SSL negotiation error
### Additional Context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL [rocketmq-clients]
Posted by "lizhanhui (via GitHub)" <gi...@apache.org>.
lizhanhui commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987738723
Anyway, this is not a bug.
You are welcome to add a feature, trusting non-CA server certificates. And this feature is best guarded by a configuration flag.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Enhancement] Support multiple TLS use cases: CA-signed, self-signed server certificates [rocketmq-clients]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-2053816287
This issue was closed because it has been inactive for 3 days since being marked as stale.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL with a server certificate issued by a non-CA entity [rocketmq-clients]
Posted by "lizhanhui (via GitHub)" <gi...@apache.org>.
lizhanhui commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987732704
FYI: https://github.com/yasushi-saito/grpc-ssl-example/blob/master/cppclient/client.cc
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL [rocketmq-clients]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987760774
我的理解是，当配置 SetSslTargetNameOverride("localhost") 时，而生产场景使用 ca 颁发的证书，此时会导致 ssl 无法开启。添加一个开关，当测试场景时，用户主动开启比较合适。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL [rocketmq-clients]
Posted by "lizhanhui (via GitHub)" <gi...@apache.org>.
lizhanhui commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987774355
> 我的理解是，当配置 SetSslTargetNameOverride("localhost") 时，而生产场景使用 ca 颁发的证书，此时会导致 ssl 无法开启。添加一个开关，当测试场景时，用户主动开启比较合适。
>
> Wwhen the configuration of SetSslTargetNameOverride("localhost") is used, and production scenarios utilize ca certificates, this will result in SSL failing to negotiation. Adding a switch that users can enable during testing scenarios would be more appropriate.
>
> 
This is a known item.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL [rocketmq-clients]
Posted by "lizhanhui (via GitHub)" <gi...@apache.org>.
lizhanhui commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987771556
3 use-cases are involved:
1) transmission in clear text;
2) Accept self-signed server certificates if its SNI is localhost; This is the current default;
3) Accept CA signed certificates;
Now you are changing the default behavior to 3).
IMO, it would better not to modify the default behavior and add an extra configuring item to making 3) possible;
Or If the community can reach a concensus that 3) is a more appropriate default, we can change the default behaviro to 3) and keeping 2) possible at the same time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Enhancement] Support multiple TLS use cases: CA-signed, self-signed server certificates [rocketmq-clients]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-2048637415
This issue is stale because it has been open for 30 days with no activity. It will be closed in 3 days if no further activity occurs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Enhancement] Support multiple TLS use cases: CA-signed, self-signed server certificates [rocketmq-clients]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #698: [Enhancement] Support multiple TLS use cases: CA-signed, self-signed server certificates
URL: https://github.com/apache/rocketmq-clients/issues/698
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Fix SSL negotiation error when C++ client enables SSL with a server certificate issued by a non-CA entity [rocketmq-clients]
Posted by "lizhanhui (via GitHub)" <gi...@apache.org>.
lizhanhui commented on issue #698:
URL: https://github.com/apache/rocketmq-clients/issues/698#issuecomment-1987724904
"What Did You Expect to See?
SSL negotiation success"
@lizhimins
This does not make sense. If the server certificate is not signed by CA, clients reject it by design.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org