Replies: 1 comment 3 replies
-
|
@jonsch318 Can you share a packet capture of just the failed and working handshake? Wireshark should let you edit it to remove unrelated frames. The other thing might be to run one of the OpenSSL based connections tools ( This is strange. :-) |
Beta Was this translation helpful? Give feedback.
3 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
I have a certificate bundle (my intermediate ca and a root ca for openbao) set as the
tls_cert_fileand the private key attls_key_file. Config looks like:I have 2 problems.
My Envoy reverse proxy cannot create a connection to openbao:8200 giving the following error:
upstream connect error or disconnect/reset before headers. reset reason: remote connection failure, transport failure reason: TLS_error:|268435736:SSL routines:OPENSSL_internal:NO_SUPPORTED_VERSIONS_ENABLED:TLS_error_endMaybe somewhat related when scaling up 2 multiple openbao instances.
the api_addr and cluster_addr are correctly set & used, but again no tls cipher suite can be negotiated.
the active server has:
(the EOF are probably from envoy)
!!However
When using tls_passthrough or port-forwarding the browser can correctly negotiate and connect via tls. Just for reference my browser uses:
TLS 1.3, X25519MLKEM768andAES_128_GCM.My complete certficate chain is a normal ECDSA-p256 with either SHA-512 or SHA-256 so nothing fancy.
Beta Was this translation helpful? Give feedback.
All reactions