-
Notifications
You must be signed in to change notification settings - Fork 9.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
clientv3: cert check fails when using multiple servers #5871
Comments
I have the same problem , the cert normal work on v2 |
@equinox0815 @yorkart it's a go-grpc bug. Submitted a patch to upstream: grpc/grpc-go#756 |
heyitsanthony
pushed a commit
to heyitsanthony/etcd
that referenced
this issue
Jul 14, 2016
Merged
heyitsanthony
pushed a commit
to heyitsanthony/etcd
that referenced
this issue
Jul 14, 2016
heyitsanthony
pushed a commit
to heyitsanthony/etcd
that referenced
this issue
Jul 14, 2016
heyitsanthony
pushed a commit
to heyitsanthony/etcd
that referenced
this issue
Jul 15, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We have a problem with HTTPs certificate checks using the clientv3 API.
Our test setup consist of 2 etcd instances (downloaded from https://github.com/coreos/etcd/releases):
They get started using the following script:
192.0.2.1/32
and192.0.2.2/32
are aliases on the loopback interface.The certificates got generated using
hack/tls-setup
with a slightly changed Makefile. We just added-hostname 192.0.2.x
to the call to cfssl for etcd1 and etcd2.So we have 2 different certificates. etcd1.pem has
X509v3 Subject Alternative Name
set toIP Address:192.0.2.1
and etcd2.pem hasX509v3 Subject Alternative Name
set toIP Address:192.0.2.2
.Using
openssl s_client -CAfile certs/ca.pem -connect 192.0.2.x:2379
we can confirm that both instances deliver the correct certificate. But when we do a query on the cluster the following happens:If we specify only one of the two endpoints everything works as expected.
It seems as if the client somehow mixes up the hostnames and endpoints.
The text was updated successfully, but these errors were encountered: