Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Confusing Error when using untrusted private CA #235

Open
ylorph opened this issue Dec 12, 2022 · 0 comments
Open

Confusing Error when using untrusted private CA #235

ylorph opened this issue Dec 12, 2022 · 0 comments

Comments

@ylorph
Copy link
Contributor

ylorph commented Dec 12, 2022

Describe the bug
Error Message is confusing when the private CA is not trusted & using discovery or gossip seed
with a connection like esdb+discover://[SomeDomain]:2113 or esdb://[node1]:2113,[node2]:2113,[node3]:2113
It says Failed to discover candidate in 10 attempts.
while actually the certificate chain is not trusted

To Reproduce
Steps to reproduce the behavior:

  1. create a 3 node cluster with a private CA
  2. do NOT trust the root ca
  3. append / read an event with the C# client

Expected behavior
An error message telling the problem is that the certificate presented by the node is not trusted .
and that either the root CA should be added to the trusted store certificates or tlsVerifyCert=false added to the connection string

  • some details about the problematic certificate

Actual behavior
Error message is

Unhandled exception. EventStore.Client.DiscoveryException: Failed to discover candidate in 10 attempts.
at EventStore.Client.GossipChannelSelector.DiscoverAsync(CancellationToken cancellationToken)
at EventStore.Client.GossipChannelSelector.SelectChannelAsync(CancellationToken cancellationToken)`

That error is confusing , as the first reason that would pop into one's mind is that the discovery failed due to some network problem or the cluster being down .

Config/Logs/Screenshots

EventStore details

  • EventStore server version: 22.10.0

  • Operating system: WIN 111

  • EventStore client version (if applicable): 22.0.0

Additional context
the error goes away when using esdb+discover://[SomeDomain]:2113?tlsVerifyCert=false but I wouldn't recommend that in a production scenario.
The client should be explicit about the problem to help diagnose & eventually give tips on how to solve

I guess this would be true for any root or certificate in the chain that would not be trusted.

@ylorph ylorph changed the title Confusing Error when using private CA Confusing Error when using untrusted private CA Dec 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant