You are viewing a plain text version of this content. The canonical link for it is here.
Posted to devnull@infra.apache.org by "bgold0 (GitHub)" <gi...@apache.org> on 2018/08/21 19:49:53 UTC
[GitHub] [couchdb-docker] bgold0 opened issue #98: SSL_ERROR_SYSCALL
when enabled SSL
Hi all,
I'm getting an error when trying to enable SSL using this endpoint. Not quite sure why this is happening and would love for you guys to take a look at my docker file and see if I am doing anything wrong or if this is an internal issue.
## Expected Behavior
The expected behavior is not to get a refused connection when using https
## Current Behavior
When I do a request to the https endpoint, I get the following error:
> curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:6984
## Possible Solution
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->
## Steps to Reproduce (for bugs)
1. Use the following docker config, and make any curl request to https
```
# Generate SSL cert.
FROM frapsoft/openssl as config-builder
WORKDIR /exports
RUN openssl req -nodes -newkey rsa:2048 -keyout privkey.pem -out couchdb.pem -subj "/C=US/ST=Texas/L=Austin/O=Security/OU=IT Department/CN=couchdb"
RUN echo $'\n\
[chttpd] \n\
bind_address = 0.0.0.0\n\
[daemons] \n\
httpsd = {chttpd, start_link, [https]}\n\
[ssl]\n\
cert_file = /etc/couchdb/cert/couchdb.pem\n\
key_file = /etc/couchdb/cert/privkey.pem\n\
' > local.ini
# Kick off database with configuration
FROM couchdb:2.2.0
COPY --from=config-builder /exports/couchdb.pem /etc/couchdb/cert/couchdb.pem
COPY --from=config-builder /exports/privkey.pem /etc/couchdb/cert/privkey.pem
COPY --from=config-builder /exports/local.ini /opt/couchdb/etc/local.ini
ENV COUCHDB_USER admin
ENV COUCHDB_PASSWORD password
EXPOSE 5984 5986 6984
````
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
@bgold0 I noticed your error is with LibreSSL, which we don't install inside the container.
Can you please try installing OpenSSL on your Docker host instead of LibreSSL and trying again?
If this fixes the problem, we'll have to update our installation instructions to require OpenSSL instead of LibreSSL.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
Try adding `-3` (enables SSLv3) to your curl command and see if that works. If so there's a configuration error on the CouchDB side (and this isn't a Docker issue as a result.)
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
Cannot reproduce, please reopen if you can provide a full test case for us to validate.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali closed issue #98: SSL_ERROR_SYSCALL
when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
[ issue closed by wohali ]
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
@bgold0 This would be on your host system. If it's a Debian/Ubuntu type, `apt install openssl` should do it.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] bgold0 commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "bgold0 (GitHub)" <gi...@apache.org>.
@wohali I'd be happy to but I honestly have no idea how I would go about doing this.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
@bgold0 Can you try swapping out LibreSSL for OpenSSL and test again for me please?
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
@bgold0 If you add `-v` to your curl command, you'll possibly find that the root cert for your CouchDB server isn't installed.
Erlang (and CouchDB) can't handle the combined cert+cacert approach. You need to specify all three:
```
[ssl]
cert_file = ...
key_file = ...
cacert_file = ...
```
Can you try including your root cert in cacert (not chained) and see if this helps? Also, can you check the CouchDB logfile and see if there's anything useful in there? If neither of these help, can you add `-v` to your curl command and paste the output here so we can get more detail on the problem?
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] bgold0 commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "bgold0 (GitHub)" <gi...@apache.org>.
Thanks @wohali for the insight. I will try to get a cacert_file in there as well and see what comes up. Here is my output which, granted I don't know what it means, but the fact that is says `CApath: none` might be a hint.
```
* Rebuilt URL to: https://localhost:6984/
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 6984 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:6984
```
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] wohali commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "wohali (GitHub)" <gi...@apache.org>.
We'll look into this, but I'd highly recommend terminating SSL at your load balancer and not using the inbuilt https support in CouchDB. Erlang's implementation leaves something to be desired.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] bgold0 commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "bgold0 (GitHub)" <gi...@apache.org>.
@wohali appears to be the same style of error
```
bryan$ curl -v -3 https://127.0.0.1:6984
* Rebuilt URL to: https://127.0.0.1:6984/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 6984 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* SSLv3 (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:6984
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:6984
```
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org
[GitHub] [couchdb-docker] bgold0 commented on issue #98:
SSL_ERROR_SYSCALL when enabled SSL
Posted by "bgold0 (GitHub)" <gi...@apache.org>.
@wohali I'd be happy to but I honestly have no idea how I would go about doing this. Any guidance would be appreciated.
[ Full content available at: https://github.com/apache/couchdb-docker/issues/98 ]
This message was relayed via gitbox.apache.org for devnull@infra.apache.org