ClickHouse / clickhouse-odbc

ODBC driver for ClickHouse
https://clickhouse.tech
Apache License 2.0
245 stars 86 forks source link

Secure Clickhouse JDBC tableau server connection not working #370

Open DipalPrajapati opened 3 years ago

DipalPrajapati commented 3 years ago

I am trying to connect to SSL enabled clickhouse from tableau server using following params in odbc.ini

[ClickHouse DSN (ANSI)]
Driver      = ClickHouse ODBC Driver (ANSI)
Description = DSN (localhost) for ClickHouse ODBC Driver (ANSI)
Url         = https://host7:32200
Server      = host
Database    = dma
UID         = clickhouse
PWD         = admin123
Port        = 32200
Proto       = https
trace       = 1
tracefile   = /tmp/clickhouse-odbc.log
debug       = 1
debugfile   = /tmp/debugClickhouse-odbc.log
sslmode = allow
privatekeyfile = /certs/tls.key
certificatefile = /certs/tls.crt
calocation = /certs/ca.crt
DriverLog = yes
DriverLogFile = /tmp/chlickhouse-odbc-driver.log

in debug log it says


1628269413689090 [19911:140590687696640] /home/denis/dev/altinity/clickhouse-odbc-canonical/driver/statement.cpp:182 in requestNextPackOfResultSets: Http request try=4/3 failed: Certificate validation error: Unacceptable certificate from my.host: application verification failure
1628269413689220 [19911:140590687696640] /home/denis/dev/altinity/clickhouse-odbc-canonical/driver/driver.h:244 in operator(): HY000 (Certificate validation error: Unacceptable certificate from my.host: application verification failure)
1628269413690722 [19911:140590980186880] /home/denis/dev/altinity/clickhouse-odbc-canonical/driver/api/odbc.cpp:56 in SQLFreeHandle: SQLFreeHandle handleType=3 handle=0x7fdd900008d0

Can anyone helps with creating certs or make it working please? Note: TLS Clickhouse is running inside a pod and tableau is running on bare host.

traceon commented 3 years ago
sslmode = allow
privatekeyfile = /certs/tls.key
certificatefile = /certs/tls.crt
calocation = /certs/ca.crt

Either leave sslmode = allow only in that list, which will be insecure, or remove it and leave the rest, and make sure certificates can be validated without errors.