Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(certificates): use real DNS names in SAN extension #9912

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dimakr
Copy link
Contributor

@dimakr dimakr commented Jan 23, 2025

After enabling peer verification, the cassandra-stress command is failing SSL handshakes with DB nodes, on GCE and Azure backends.
The issue root cause is because SCT uses hostnames instead of real DNS names for DB nodes on these backends. As a result, the hostnames are included in the SAN extension of nodes' certificates. The mismatch causes peer verification failures, as the hostnames do not align with the actual DNS names.

The change ensures retrieval and use of real DNS names for DB nodes on GCE and Azure backends.

Fixes: #9883 (comment)

Testing

PR pre-checks (self review)

  • I added the relevant backport labels
  • I didn't leave commented-out/debugging code

Reminders

  • Add New configuration option and document them (in sdcm/sct_config.py)
  • Add unit tests to cover my changes (under unit-test/ folder)
  • Update the Readme/doc folder relevant to this change (if needed)

After enabling peer verification, the cassandra-stress command is failing SSL handshakes
with DB nodes, on GCE and Azure backends.
The issue root cause is because SCT uses hostnames instead of real DNS names for DB
nodes on these backends. As a result, the hostnames are included in the SAN extension
of nodes' certificates. The mismatch causes peer verification failures, as the hostnames do
not align with the actual DNS names.

The change ensures retrieval and use of real DNS names for DB nodes on GCE and
Azure backends.
@dimakr dimakr added the backport/none Backport is not required label Jan 23, 2025
@dimakr dimakr marked this pull request as ready for review January 24, 2025 00:05
@dimakr dimakr requested review from fruch and timtimb0t January 24, 2025 00:05
@fruch fruch requested a review from a team January 26, 2025 09:22
Copy link
Contributor

@fruch fruch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/none Backport is not required
Projects
None yet
2 participants