Skip to content

Client certificate in git seem buggy - #373

Merged
borshop merged 1 commit into
masterfrom
bugfix/bch/update-certs
Oct 2, 2014
Merged

Client certificate in git seem buggy#373
borshop merged 1 commit into
masterfrom
bugfix/bch/update-certs

Conversation

@hazen

@hazen hazen commented Sep 24, 2014

Copy link
Copy Markdown

Certificates generated via the Makefile in riak/tests/resources are fine, but the checked-in client.crt does not validate against ca.crt. server.crt is fine.

$ openssl verify -CAfile ca.crt client.crt
client.crt: /C=US/ST=Washington/O=Basho/OU=Riak Python Client/CN=certuser/emailAddress=clients@basho.com
error 20 at 0 depth lookup:unable to get local issuer certificate

@hazen

hazen commented Sep 21, 2014

Copy link
Copy Markdown

Nice find, @macintux! I'll look at generating some new certs to see if that helps.

@hazen

hazen commented Sep 24, 2014

Copy link
Copy Markdown

Hopefully this batch works better for you:

openssl verify -CAfile ca.crt client.crt
client.crt: OK
openssl verify -CAfile ca.crt server.crt
server.crt: OK

@hazen

hazen commented Sep 25, 2014

Copy link
Copy Markdown

Looks like basho/riak_api#66 has already been merged in, so I'll need to get #370 fixed before this will successfully build.

@hazen
hazen force-pushed the bugfix/bch/update-certs branch from 2618807 to e2b74b9 Compare October 1, 2014 22:25
@hazen

hazen commented Oct 1, 2014

Copy link
Copy Markdown

Worked out that our certificates don't have the CRL location baked into them: https://github.com/basho/riak_api/blob/develop/src/riak_api_ssl.erl#L93. For now switch off checking, but next step will be to add a CRL to the certificate.

@seancribbs

Copy link
Copy Markdown

👍 e2b74b9

borshop added a commit that referenced this pull request Oct 2, 2014
Client certificate in git seem buggy

Reviewed-by: seancribbs
@hazen

hazen commented Oct 2, 2014

Copy link
Copy Markdown

@borshop merge

@borshop
borshop merged commit e2b74b9 into master Oct 2, 2014
@seancribbs
seancribbs deleted the bugfix/bch/update-certs branch October 2, 2014 16:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants