Closed theduderog closed 2 years ago
Hi @theduderog, thank you for the detailed write-up, we will look into this change in behavior. Do you mind creating a support ticket for this issue as well so we can get more information and investigate further?
@sarah-witt Done. Request #703748)
@hithwen why did you close the issue with no explanation?
Hi @theduderog I'm closing this issue because it is now tracked on the support ticket.
@hithwen @sarah-witt There's no meaningful action on my support case. Should we reopen this? Unless I'm missing something, dd-agent should not break backward compatibility, especially in a minor version release and needs to be fixed ASAP for all DD customers.
Additional environment details (Operating System, Cloud provider, etc): Using Docker image
datadog/agent:6.33.0-jmx
on EKS v1.18.20Steps to reproduce the issue:
init_config:
instances:
Describe the results you received:
Describe the results you expected:
I expected dd-agent to be able to check the certificate expiration and populate the
http.ssl.days_left
metricAdditional information you deem important (e.g. issue happens only occasionally):
This PR that went into version 6.26/7.26 broke backward compatibility for this check in dd-agent. Previously, the socket mode was hard coded to ssl.CERT_REQUIRED. That PR switched to using the TlsContextWrapper which only sets that mode if full verification is enabled. In
ssl.CERT_NONE
mode, the SSL Socket will not return a peer certificate leading to this error