You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/08/11 08:54:15 UTC
[GitHub] [pulsar] eronrunner created a discussion: Issue - Failed to enable ssl with JKS
GitHub user eronrunner created a discussion: Issue - Failed to enable ssl with JKS
I install pulsar by helm chart and try to add the properties
brokerServicePortTls: "{{.Values.broker.ports.pulsarssl}}"
webServicePortTls: "{{.Values.broker.ports.https}}"
tlsEnabled: "true"
# TLS Settings
tlsCertificateFilePath: "/pulsar/certs/manager.crt"
tlsKeyFilePath: "/pulsar/certs/manager.key"
tlsTrustCertsFilePath: "/pulsar/certs/ca.crt"
# tlsAllowInsecureConnection: "false"
tlsProtocols: "TLSv1.2,TLSv1.1"
## Enable KeyStore type
tlsEnabledWithKeyStore: "true"
requireTrustedClientCertOnConnect: "true"
## key store
tlsKeyStoreType: JKS
tlsKeyStore: "{{.Values.tlsKeyStore.tlsKeyStore}}"
tlsKeyStorePassword: "{{.Values.tlsKeyStore.tlsKeyStorePassword}}"
## trust store
tlsTrustStoreType: JKS
tlsTrustStore: "{{.Values.tlsKeyStore.tlsTrustStore}}"
tlsTrustStorePassword: "{{.Values.tlsKeyStore.tlsTrustStorePassword}}"
## internal client/admin-client config
brokerClientTlsEnabled: "{{.Values.tlsKeyStore.brokerClientTlsEnabled}}"
brokerClientTlsEnabledWithKeyStore: "{{.Values.tlsKeyStore.brokerClientTlsEnabledWithKeyStore}}"
brokerClientTlsTrustStoreType: JKS
brokerClientTlsTrustStore: "{{.Values.tlsKeyStore.brokerClientTlsTrustStore}}"
brokerClientTlsTrustStorePassword: "{{.Values.tlsKeyStore.brokerClientTlsTrustStorePassword}}"
I also tried some ways by disabling the HTTP port and non-ssl service port, but got the same things.
Please help!
Thank you
GitHub link: https://github.com/apache/pulsar/discussions/17065
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] tisonkun added a comment to the discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user tisonkun added a comment to the discussion: Issue - Failed to enable ssl with JKS
@eronrunner can you provide which version (os & pulsar) in used?
GitHub link: https://github.com/apache/pulsar/discussions/17065#discussioncomment-3380701
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] eronrunner edited a discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user eronrunner edited a discussion: Issue - Failed to enable ssl with JKS
I install pulsar by helm chart and try to add the properties
brokerServicePortTls: "{{.Values.broker.ports.pulsarssl}}"
webServicePortTls: "{{.Values.broker.ports.https}}"
tlsEnabled: "true"
tlsCertificateFilePath: "/pulsar/certs/manager.crt"
tlsKeyFilePath: "/pulsar/certs/manager.key"
tlsTrustCertsFilePath: "/pulsar/certs/ca.crt"
tlsProtocols: "TLSv1.2,TLSv1.1"
tlsEnabledWithKeyStore: "true"
requireTrustedClientCertOnConnect: "true"
tlsKeyStoreType: JKS
tlsKeyStore: "{{.Values.tlsKeyStore.tlsKeyStore}}"
tlsKeyStorePassword: "{{.Values.tlsKeyStore.tlsKeyStorePassword}}"
tlsTrustStoreType: JKS
tlsTrustStore: "{{.Values.tlsKeyStore.tlsTrustStore}}"
tlsTrustStorePassword: "{{.Values.tlsKeyStore.tlsTrustStorePassword}}"
brokerClientTlsEnabled: "{{.Values.tlsKeyStore.brokerClientTlsEnabled}}"
brokerClientTlsEnabledWithKeyStore: "{{.Values.tlsKeyStore.brokerClientTlsEnabledWithKeyStore}}"
brokerClientTlsTrustStoreType: JKS
brokerClientTlsTrustStore: "{{.Values.tlsKeyStore.brokerClientTlsTrustStore}}"
brokerClientTlsTrustStorePassword: "{{.Values.tlsKeyStore.brokerClientTlsTrustStorePassword}}"
I also tried some ways by disabling the HTTP port and non-ssl service port, but got the same things.
Please help!
Thank you
GitHub link: https://github.com/apache/pulsar/discussions/17065
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] tisonkun edited a comment on the discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user tisonkun edited a comment on the discussion: Issue - Failed to enable ssl with JKS
@eronrunner can you provide which version (os & pulsar) in used?
OK. It seems Pulsar version=2.9.2. If it's on MacOS, DNS resolution can meet issue described in https://github.com/apache/pulsar/discussions/17067.
GitHub link: https://github.com/apache/pulsar/discussions/17065#discussioncomment-3380701
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] nodece added a comment to the discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user nodece added a comment to the discussion: Issue - Failed to enable ssl with JKS
It looks related to DNS.
GitHub link: https://github.com/apache/pulsar/discussions/17065#discussioncomment-3380663
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] michaeljmarshall added a comment to the discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user michaeljmarshall added a comment to the discussion: Issue - Failed to enable ssl with JKS
Note that the `Failed to resolve network location` log only indicates that you have not configured racks for your bookies. It is not preventing TLS from working, and it is not attempting to do any DNS resolution, assuming you're using the broker.conf defaults.
I think we'll likely need more of the logs to answer what is going wrong. Specifically, we'll need to see the full stack trace from the client, and we'll also need to see the full stack trace from the broker.
Note that the final error is coming from this block: https://github.com/apache/pulsar/blob/a3f52891593e093c27b583094a1fbfd09bbbae1a/pulsar-client-admin/src/main/java/org/apache/pulsar/client/admin/internal/http/AsyncHttpConnector.java#L263-L266.
GitHub link: https://github.com/apache/pulsar/discussions/17065#discussioncomment-3380909
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] asafm added a comment to the discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user asafm added a comment to the discussion: Issue - Failed to enable ssl with JKS
@hangc0276 ?
GitHub link: https://github.com/apache/pulsar/discussions/17065#discussioncomment-3374082
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org
[GitHub] [pulsar] eronrunner edited a discussion: Issue - Failed to enable ssl with JKS
Posted by GitBox <gi...@apache.org>.
GitHub user eronrunner edited a discussion: Issue - Failed to enable ssl with JKS
I install pulsar by helm chart and try to add the properties
brokerServicePortTls: "{{.Values.broker.ports.pulsarssl}}"
webServicePortTls: "{{.Values.broker.ports.https}}"
tlsEnabled: "true"
tlsCertificateFilePath: "/pulsar/certs/manager.crt"
tlsKeyFilePath: "/pulsar/certs/manager.key"
tlsTrustCertsFilePath: "/pulsar/certs/ca.crt"
tlsProtocols: "TLSv1.2,TLSv1.1"
tlsEnabledWithKeyStore: "true"
requireTrustedClientCertOnConnect: "true"
tlsKeyStoreType: JKS
tlsKeyStore: "{{.Values.tlsKeyStore.tlsKeyStore}}"
tlsKeyStorePassword: "{{.Values.tlsKeyStore.tlsKeyStorePassword}}"
tlsTrustStoreType: JKS
tlsTrustStore: "{{.Values.tlsKeyStore.tlsTrustStore}}"
tlsTrustStorePassword: "{{.Values.tlsKeyStore.tlsTrustStorePassword}}"
brokerClientTlsEnabled: "{{.Values.tlsKeyStore.brokerClientTlsEnabled}}"
brokerClientTlsEnabledWithKeyStore: "{{.Values.tlsKeyStore.brokerClientTlsEnabledWithKeyStore}}"
brokerClientTlsTrustStoreType: JKS
brokerClientTlsTrustStore: "{{.Values.tlsKeyStore.brokerClientTlsTrustStore}}"
brokerClientTlsTrustStorePassword: "{{.Values.tlsKeyStore.brokerClientTlsTrustStorePassword}}"
I also tried some ways by disabling the HTTP port and non-ssl service port, but got the same things.
Please help!
Thank you
GitHub link: https://github.com/apache/pulsar/discussions/17065
----
This is an automatically sent email for dev@pulsar.apache.org.
To unsubscribe, please send an email to: dev-unsubscribe@pulsar.apache.org