Skip to content
This repository has been archived by the owner on Jan 20, 2022. It is now read-only.

Add client usage to etcd server's crt for grpc gateway into etcd #305

Closed
mmerrill3 opened this issue Mar 13, 2020 · 1 comment
Closed

Add client usage to etcd server's crt for grpc gateway into etcd #305

mmerrill3 opened this issue Mar 13, 2020 · 1 comment

Comments

@mmerrill3
Copy link

mmerrill3 commented Mar 13, 2020

From this thread (etcd-io/etcd#9785 (comment)), it appears there have been fixes in other projects to handle where etcd uses the server's crt internally when acting as a client.

I put some more info in this issue in kops: kubernetes/kops#8512

Basically, we see the following message in the etcd.log file, about every few minutes:

cat etcd.log |grep -A 1 rejected


2020-03-13 16:19:49.046488 I | embed: rejected connection from "127.0.0.1:25786" (error "tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage", ServerName "")
WARNING: 2020/03/13 16:19:49 grpc: addrConn.createTransport failed to connect to {0.0.0.0:4001 0  <nil>}. Err :connection error: desc = "transport: authentication handshake failed: remote error: tls: bad certificate". Reconnecting...
--
2020-03-13 16:22:01.577902 I | embed: rejected connection from "127.0.0.1:36272" (error "tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage", ServerName "")
WARNING: 2020/03/13 16:22:01 grpc: addrConn.createTransport failed to connect to {0.0.0.0:4001 0  <nil>}. Err :connection error: desc = "transport: authentication handshake failed: remote error: tls: bad certificate". Reconnecting...
--
2020-03-13 16:23:45.243584 I | embed: rejected connection from "127.0.0.1:44390" (error "tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage", ServerName "")
WARNING: 2020/03/13 16:23:45 grpc: addrConn.createTransport failed to connect to {0.0.0.0:4001 0  <nil>}. Err :connection error: desc = "transport: authentication handshake failed: remote error: tls: bad certificate". Reconnecting...


It appears the messages are benign, but they are much more prevalent in 3.4.3 than earlier versions of etcd (3.3.13).

We could add client usage to the server certificate in options.go when we make the GRPCServerConfig.

I am not sure why this is more visible in etcd 3.4.3 versus version 3.3.13.

mmerrill3 pushed a commit to mmerrill3/etcd-manager that referenced this issue Mar 16, 2020
mmerrill3 pushed a commit to mmerrill3/etcd-manager that referenced this issue Mar 16, 2020
mmerrill3 pushed a commit to mmerrill3/etcd-manager that referenced this issue Mar 18, 2020
mmerrill3 pushed a commit to mmerrill3/etcd-manager that referenced this issue Mar 27, 2020
justinsb added a commit that referenced this issue Apr 7, 2020
…h-ext

Adding client usage extension for server cert (#305)
@mmerrill3
Copy link
Author

this is fixed.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant