OpenSSL 3 SSL Library Error: error:0A000126:SSL routines::unexpected eof while reading #325
Comments
|
Have you figured anything out with this? I am having the same issue using the same versions of Foreman, Katello and the Proxmox Plugin. It was working when I was on Foreman 3.8 and Katello 4.10. I had issues upgrading so I decided to build from scratch and now I cannot get it to work again. |
|
@phantomdez on which OS runs your katello deployment? |
|
Rocky Linux 9 just like you. I do have a signed certificate for my host through Let's Encrypt. |
|
All deployed as default. i have not enabled the verification in the compute resource. and all "tests" do succeed. |
|
Any updates on this issue? I'm seeing this problem when running: OS: AlmaLinux 9.4
Workaround: A work around for this issue is to “Disassociate Hosts”, carry out any modifications, and then re-associate the VM in the compute resource. Until this is fixed I'm going to have to roll back to Foreman running on EL8. :( |
|
I found a workaround here: https://community.theforeman.org/t/ssl-error-on-create-image/37947/6 (Not recommended in prod) I've tested it and it works on AlmaLinux 9.4. |
|
Thanks for sharing! I'll try that in the upcoming weeks. |
|
indeed. those workarounds do help here. found other issues but unrelated to the initial report. |
|
Under Debian 12, a system-wide workaround could be to add opts |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF so the block looks like: module OpenSSL
module SSL
class SSLContext
DEFAULT_PARAMS = { # :nodoc:
:min_version => OpenSSL::SSL::TLS1_VERSION,
:verify_mode => OpenSSL::SSL::VERIFY_PEER,
:verify_hostname => true,
:options => -> {
opts = OpenSSL::SSL::OP_ALL
opts &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
opts |= OpenSSL::SSL::OP_NO_COMPRESSION
opts |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF
opts
}.call
} |
Describe the bug
I deployed Katello on a new EL9 (RockyLinux) machine and cant deploy VMs.
I can configure the compute resource and also see the existing VMs in the Virtual Machines tab.
Association is also possible if the VM is registered.
In some places some stuff does not work.
The error is:
SSL_read: unexpected eof while reading (OpenSSL::SSL::SSLError)(Tried w/ and w/o "SSL verify peer" and full X509 cert in compute resources)
Where the error occurs:
This is a issue / new behavior of openssl. Explained here: openssl/openssl#22690 (comment)
TL;DR:
proxmox does not send a "close_notify" at the end and openssl errors out.
there is the option
SSL_OP_IGNORE_UNEXPECTED_EOFto get the old "wrong" handling of openssl < 3.The advertised workaround did not work for me. (configuration through
/etc/pki/tls/openssl.cnf)Is this something the plugin itself can handle?
katello log from provisioning
To Reproduce
Steps to reproduce the behavior:
Openssl version:
Katello version:
Proxmox version:
Expected behavior
Successfully deployed VM.
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
Smartphone (please complete the following information):
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: