You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by randall <gi...@git.apache.org> on 2017/01/18 23:05:11 UTC
[GitHub] trafficserver issue #1341: openssl errors for every request
GitHub user randall opened an issue:
https://github.com/apache/trafficserver/issues/1341
openssl errors for every request
With ATS 7.1, the server will come up cleanly (same configs that work fine under 7.0.0), but a request will generate the following log lines.
`Jan 18 17:36:05 hostname traffic_server[380]: {0x2ae6a690c700} ERROR: SSL::47170125350656:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: TRUSTED CERTIFICATE
Jan 18 17:36:05 hostname traffic_server[380]: {0x2ae6a690c700} ERROR: SSL::47170125350656:error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib:ssl_rsa.c:708
Jan 18 17:36:05 hostname traffic_server[380]: {0x2ae6a690c700} ERROR: failed to load client certificate from (null)`
The request completes successfully, but is very noisy server side.
----
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver issue #1341: openssl errors for every request
Posted by zwoop <gi...@git.apache.org>.
Github user zwoop commented on the issue:
https://github.com/apache/trafficserver/issues/1341
Looking at 63b924e8, it seems we produce this error, and do these expensive lookups / additions on every request?
```C++
@@ -4018,7 +4020,7 @@ HttpSM::do_remap_request(bool run_inline)
{
DebugSM("http_seq", "[HttpSM::do_remap_request] Remapping request");
DebugSM("url_rewrite", "Starting a possible remapping for request [%" PRId64 "]", sm_id);
-
+ SSLConfig::scoped_config params;
bool ret = false;
if (t_state.cop_test_page == false) {
ret = remapProcessor.setup_for_remap(&t_state);
@@ -4059,6 +4061,16 @@ HttpSM::do_remap_request(bool run_inline)
pending_action = remap_action_handle;
}
+ // check if the overridden client cert filename is already attached to an existing ssl context
+ ats_scoped_str clientCert(Layout::relative_to(t_state.txn_conf->client_cert_filepath, t_state.txn_conf->client_cert_filename));
+ auto tCTX = params->getCTX(clientCert);
+
+ if (tCTX == nullptr) {
+ // make new client ctx and add it to the ctx list
+ auto tctx = params->getNewCTX(clientCert);
+ params->InsertCTX(clientCert, tctx);
+ }
+
```
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver issue #1341: openssl errors for every request
Posted by persiaAziz <gi...@git.apache.org>.
Github user persiaAziz commented on the issue:
https://github.com/apache/trafficserver/issues/1341
PR: https://github.com/apache/trafficserver/pull/1347/files
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver issue #1341: openssl errors for every request
Posted by bryancall <gi...@git.apache.org>.
Github user bryancall commented on the issue:
https://github.com/apache/trafficserver/issues/1341
This has been resloved
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver issue #1341: openssl errors for every request
Posted by randall <gi...@git.apache.org>.
Github user randall commented on the issue:
https://github.com/apache/trafficserver/issues/1341
The full stack from the thread hitting this:
[stack.txt](https://github.com/apache/trafficserver/files/715338/stack.txt)
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver issue #1341: openssl errors for every request
Posted by bryancall <gi...@git.apache.org>.
Github user bryancall closed the issue at:
https://github.com/apache/trafficserver/issues/1341
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---