Error with certificates trying to retrieve a secret

R3DRUN3 commented 1 year ago

Summary

When I try to retrieve a secret, I get the following error: x509: certificate is not standards compliant.

I noticed it may be related to this issue however, even trying from ubuntu, I get a certificate error, albeit a different one: x509: certificate signed by unknown authority.

Steps to Reproduce

The following is the Go script that I am using:

package main

import (
    "fmt"
    "os"

    "github.com/cyberark/conjur-api-go/conjurapi"
    "github.com/cyberark/conjur-api-go/conjurapi/authn"
)

func main() {
    variableIdentifier := "secrets/TEST-VARIABLE-TEKTON-PIPELINE"

    config, err := conjurapi.LoadConfig()
    if err != nil {
        panic(err)
    }

    conjur, err := conjurapi.NewClientFromKey(config,
        authn.LoginPair{
            Login:  os.Getenv("CONJUR_AUTHN_LOGIN"),
            APIKey: os.Getenv("CONJUR_AUTHN_API_KEY"),
        },
    )
    if err != nil {
        panic(err)
    }

    // Retrieve a secret into []byte.
    secretValue, err := conjur.RetrieveSecret(variableIdentifier)
    if err != nil {
        panic(err)
    }
    fmt.Println("The secret value is: ", string(secretValue))

    // Retrieve a secret into io.ReadCloser, then read into []byte.
    // Alternatively, you can transfer the secret directly into secure memory,
    // vault, keychain, etc.
    secretResponse, err := conjur.RetrieveSecretReader(variableIdentifier)
    if err != nil {
        panic(err)
    }

    secretValue, err = conjurapi.ReadResponseBody(secretResponse)
    if err != nil {
        panic(err)
    }
    fmt.Println("The secret value is: ", string(secretValue))
}

Expected Results

The program complete the secret retrieval without errors.

Actual Results

See the above errors.

Reproducible

[X] Always (in my environment)

Version/Tag number

go version: go1.20.4 darwin/amd64 library version: github.com/cyberark/conjur-api-go v0.11.0

Environment setup

The script is launched from localhost and the Conjur instance is on a remote VM (connection via VPN).

Additional Information

I get the same error with the terraform conjur provider. The config env vars are ok: I've succesfully run a bash script with the same values and it works.

It seems that the problem is related to self signed certificates, is there a way to bypass this check? Thank you.

R3DRUN3 commented 1 year ago

NOTE I was able to bypass this problem by specifying the full certificate chain instead of just the Conjur host certificate, this also solved the problems that I was having with terraform-provider-conjur (based upon this Go library).

I don't know if this behavior is intentional, it seems a little strange having to specify the entire certificate chain bundle... In fact, it seems strange and a bit unconventional having to specify a public SSL certificate at all 🤔

The same problem occurred (and was bypassed) in the same way in the conjur-puppet module as well (see this issue).

szh commented 1 year ago

Hi @R3DRUN3,

Are you using a self-signed certificate? Can you please post the values of your loaded config?

R3DRUN3 commented 1 year ago

Hi @szh, yes it is a self signed certificate:

I saved this in a file called conjur and then I launch the Go script via a bash script:

#!/bin/bash

export CONJUR_APPLIANCE_URL="https://10.7.0.122"
export CONJUR_ACCOUNT="default"
export CONJUR_AUTHN_LOGIN="host/conjur/tekton-pipeline-demo"
export CONJUR_AUTHN_API_KEY="<conjur-api-key-here>"
export CONJUR_CERT_FILE="conjur"

go run main.go