elastic / elasticsearch-rs

Official Elasticsearch Rust Client
https://www.elastic.co/guide/en/elasticsearch/client/rust-api/current/index.html
Apache License 2.0
695 stars 70 forks source link

[BUG] ca chain doesn't seen to work #180

Closed Stargateur closed 2 years ago

Stargateur commented 2 years ago

I follow this to the LETTER https://jamielinux.com/docs/openssl-certificate-authority/introduction.html. I create my root certificate, my intermediate one, and my final one. All work, I have my postgresql server that launch correctly, I can connect to it with pgadmin 4 with verify-full using the full chain root certificate ca-chain.cert.pem (and I can't without the file) so it's work but:

pub async fn new() -> Result<DB> {
    let cert = native_tls::Certificate::from_pem(
        &utils::read(&OPTIONS.postgrepsql.certificate).context(Io)?,
    )
    .context(Tls)?;

    let tls = MakeTlsConnector::new(
        TlsConnector::builder()
            .add_root_certificate(cert)
            .build()
            .context(Tls)?,
    );

    let config = tokio_postgres::Config::from_str(&format!(
        "{} sslmode=require",
        OPTIONS.postgrepsql.config()
    ))
    .context(PostgreSQL)?;

    let manager = Manager::new(config, tls);

    let pool = Pool::from_config(manager, PoolConfig::default());

    Ok(DB { pool })
}

pub fn config(&self) -> String {
    format!(
        "host={} port={} user={} password={}",
        self.host,
        self.port,
        self.user,
        self.password.expose_secret()
    )
}

Doesn't work, linux:

Jul 16 17:10:36.600 DEBUG optomata::internal_server_error: Pool { source: Backend(Error { kind: Tls, cause: Some(Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 337047686, library: "SSL routines", function: "tls_process_server_certificate", reason: "certificate verify failed", file: "ssl/statem/statem_clnt.c", line: 1913 }]))) }, X509VerifyResult { code: 2, error: "unable to get issuer certificate" })) }) }

windows error:

Jul 16 18:56:20.468 DEBUG optomata::internal_server_error: Pool { source: Backend(Error { kind: Tls, cause: Some(Os { code: -2146762487, kind: Other, message: "Une chaîne de certificats a été traitée mais s’est terminée par un certificat racine qui n’est pas approuvé par
 le fournisseur d’approbation." }) }) }

Environment:

I try to check and check and double check everything, I don't understand why it doesn't work.

Stargateur commented 2 years ago

wtf so sorry I totally mix up my tab