You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "PPisz (via GitHub)" <gi...@apache.org> on 2024/11/21 15:22:35 UTC
[I] ssvm: unable to find valid certification path to requested target [cloudstack]
PPisz opened a new issue, #9962:
URL: https://github.com/apache/cloudstack/issues/9962
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Bug Report
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, VR, VPN, UI, etc.
-->
~~~
secondary storage vm
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main branch.
-->
~~~
4.19.3
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. basic network, advanced networking, etc. N/A otherwise
-->
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
##### SUMMARY
<!-- Explain the problem/feature briefly -->
Can't download and register a template/iso from a site secured with a letsencrypt certificate, for example: https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v1.8.3/metal-amd64.iso
Even after manually importing all letsencryt certificates it doesn't work correctly.
##### STEPS TO REPRODUCE
<!--
For bugs, show exactly how to reproduce the problem, using a minimal test-case. Use Screenshots if accurate.
For new features, show how the feature would be used.
-->
<!-- Paste example playbooks or commands between quotes below -->
~~~
Create fresh ssvm 4.19.3 and import iso
~~~
<!-- You can also paste gist.github.com links for larger files -->
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
We can download template/iso from letsencrypt certificate sites
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
<!-- Paste verbatim command output between quotes below -->
~~~
2024-11-21 15:08:55,587 INFO [storage.template.HttpTemplateDownloader] (agentRequest-Handler-3:null) No credentials configured for host=factory.talos.dev:443
2024-11-21 15:08:56,461 INFO [storage.template.DownloadManagerImpl] (pool-1-thread-2:null) Download Completion for jobId: a4d992d1-0ae8-4a66-bbcd-2b5973506bd8, status=UNRECOVERABLE_ERROR
2024-11-21 15:08:56,484 INFO [storage.template.DownloadManagerImpl] (pool-1-thread-4:null) local: /mnt/SecStorage/9bf7d36f-f049-3f71-89a8-101bacf6be00/template/tmpl/36/263/dnld2856126097776773813tmp_, bytes=(0 bytes) 0, error=PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target, pct=0
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "PPisz (via GitHub)" <gi...@apache.org>.
PPisz commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2507767814
@weizhouapache You are a genius, this fix solves the problem :-)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2510876708
> @weizhouapache should we solve this isn docs or in the install scripts?
@DaanHoogland
I asked chatgpt which gave me the following answer, just for your information
===================
Yes, enabling the Java SNI (Server Name Indication) extension is generally recommended, and in fact, it is enabled by default in modern Java versions (Java 7 and above). Here’s why enabling SNI is important:
1. Essential for Modern TLS/SSL Communication
SNI is a necessary extension of the TLS protocol that allows the client to send the hostname it is connecting to during the handshake. This is critical when multiple SSL certificates are used on the same IP address.
Without SNI, a server would not be able to determine which SSL/TLS certificate to present during the handshake, leading to certificate errors or insecure connections. Enabling SNI ensures the client can connect to the correct host and receive the appropriate certificate.
2. Compatibility with Modern Web Servers
Most modern web servers (like Apache, Nginx, and IIS) rely on SNI to serve multiple websites (with different SSL certificates) from the same IP address.
Disabling SNI would result in connection failures when accessing websites hosted on such servers, because the server wouldn't know which certificate to use for the connection.
3. Improves Security
Enabling SNI allows for more secure, host-specific certificates to be presented. This prevents scenarios where a generic or incorrect certificate might be served, which could potentially lead to man-in-the-middle (MITM) attacks or insecure connections.
By using SNI, the client and server ensure that the correct TLS certificate is negotiated based on the hostname requested, which is essential for maintaining encryption and trust.
4. Supported by Java Out-of-the-Box
Starting from Java 7, SNI support is included natively, so most Java applications do not need any additional configuration to enable it. If you're using Java 7 or later, it's automatically enabled for SSL/TLS connections, and there’s no need to explicitly enable or disable it unless you're dealing with special configurations or compatibility requirements.
5. Avoids Issues with Hosting Multiple Services
If you're using a server that hosts multiple domains (virtual hosting) on the same IP address, SNI is required to ensure that the correct SSL certificate is served for each domain.
For example, if you are trying to connect to example.com and example.org on the same server, the server uses the SNI to determine which SSL certificate to present.
6. Performance and Scalability
Without SNI, a server may need separate IP addresses for each certificate, which can lead to inefficient resource usage. With SNI enabled, multiple SSL certificates can be served on the same IP, reducing the need for multiple IP addresses and enhancing scalability.
How to Ensure SNI is Enabled in Java:
Java 7 and later: SNI is enabled by default, and applications using HttpsURLConnection, SSLContext, or other SSL/TLS-related classes should work seamlessly with SNI-enabled servers.
If you're using an older version of Java (Java 6 or below), SNI support might be absent or require external libraries like JSSE (Java Secure Socket Extension) to add support.
Conclusion:
You should enable the SNI extension in Java, as it is a vital feature for securely and properly handling HTTPS requests in modern applications. It ensures compatibility with servers that host multiple SSL certificates and prevents connection and security issues. If you're using Java 7 or above, SNI is already enabled by default, so there's typically no need for additional configuration.
===================
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2523292052
fixed in #10028
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland closed issue #9962: ssvm: unable to find valid certification path to requested target
URL: https://github.com/apache/cloudstack/issues/9962
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "PPisz (via GitHub)" <gi...@apache.org>.
PPisz commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2498976694
> @PPisz , I think you mean version 4.19.1.3, right? (instead of 4.19.3)
Yes, 4.19.1.3
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2514114397
> Djsse.enableSNIExtension=false
it is enabled by java, but in cloudstack script _run.sh, it has `Djsse.enableSNIExtension=false` ...
we should set it to true, or remove it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2497346758
@PPisz , can you confirm this worked before, in 4.19.1.2 or earlier?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "PPisz (via GitHub)" <gi...@apache.org>.
PPisz commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2498976147
Unfortunately I don't know how it looked like on earlier versions, it certainly didn't work on 4.19.1.2
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2505948606
an update
- I was able to register an ISO with URL https://www.shapeblue.com/404.iso (it results 404 error)
- the site www.shapeblue.com uses let's encrypt R10 certificate, while factory.talos.dev use R11 certificate
https://ssl-tools.net/webservers/www.shapeblue.com
https://ssl-tools.net/webservers/factory.talos.dev
I am not sure if it causes the issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2504670624
I can also reproduce the issue with 4.19.1 and 4.20.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2510836155
@weizhouapache should we solve this isn docs or in the install scripts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2514089783
sounds like we should not do anything as it is already enabled by default. (or at most remove the option from the start script)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2497341668
@PPisz , I think you mean version 4.19.1.3, right? (instead of 4.19.3)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2503706912
I can confirm this is an issue in latest 4.18 as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ssvm: unable to find valid certification path to requested target [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9962:
URL: https://github.com/apache/cloudstack/issues/9962#issuecomment-2507657383
@PPisz
can you log into ssvm and run the following commands ?
```
sed -i "s/Djsse.enableSNIExtension=false/Djsse.enableSNIExtension=true/g" /usr/local/cloud/systemvm/_run.sh
systemctl restart cloud
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org