You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As per the recent SSL improvements in 5.7.34, the joiner generates and sends a
secret message consisting of a random string + Common Name of the SSL
certificate together within the address in State Transfer Request in order
to authenticate the donor on connection.
However, the logic of fetching the Common Name from the certificate
doesn't work well for the auto-generated SSL certificates, resulting
in the SST failure.
WSREP_SST: [INFO] Encrypting with CERT: /home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/server-cert.pem, KEY: /home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/server-key.pem, CA: /home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/ca.pem (20211105 09:06:02.030)
...
WSREP_SST: [INFO] Evaluating xbstream -c ${INFO_FILE} | socat -u stdio openssl-connect:127.0.0.1:5020,cert=/home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/server-cert.pem,key=/home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/server-key.pem,cafile=/home/venki/work/pxc/refresh/codership-mysql-wsrep/bld/pxc-node/cert/ca.pem,verify=1,commonname='CN '; RC=( ${PIPESTATUS[@]} ) (20211105 09:06:02.045)
2021/11/05 09:06:02 socat[18518] E certificate is valid but its commonName does not match hostname
WSREP_SST: [ERROR] Error while sending data to joiner node: exit codes: 0 1 (20211105 09:06:02.053)
Here it used "CN " as the common name for the SST.
Steps to reproduce:
Initialize the server with --ssl option to auto-generate the SSL certificates.
Use the same auto-generated ssl-ca, ssl-cert and ssl-key certificates during the SST by specifying the options in the [sst] section of the joiner cnf file.
When the MySQL server generates its own SSL certificates, it uses the
below Common Names for its certificates (See
do_auto_cert_generation()
).As per the recent SSL improvements in 5.7.34, the joiner generates and sends a
secret message consisting of a random string + Common Name of the SSL
certificate together within the address in State Transfer Request in order
to authenticate the donor on connection.
However, the logic of fetching the Common Name from the certificate
doesn't work well for the auto-generated SSL certificates, resulting
in the SST failure.
This is because of the fact that the logic used in https://github.com/codership/mysql-wsrep/blob/wsrep_5.7.34-25.26/scripts/wsrep_sst_xtrabackup-v2.sh#L1099-L1101 doesn't work with auto-generated certificates.
Here it used "CN " as the common name for the SST.
Steps to reproduce:
--ssl
option to auto-generate the SSL certificates.ssl-ca
,ssl-cert
andssl-key
certificates during the SST by specifying the options in the[sst]
section of the joiner cnf file.Suggestion:
The proper command should be
The text was updated successfully, but these errors were encountered: