Cannot connect to Riak via SSL about riak-ruby-client HOT 9 CLOSED

Don't feel too bad, I've found TLS issues with Ruby's OpenSSL bindings to be very difficult to troubleshoot, and I understand the stuff!

The first thing I'd attempt is adding a ca_file to your authentication configuration: http://basho.github.io/riak-ruby-client/config.html#toc-security . It's possible that OpenSSL may not be looking in the right place for the CA-bundle.

If that doesn't work, there's some extra information we can grab with Wireshark, but that's a whole new world of complication, and even harder to redact.

from riak-ruby-client.

That's what I was thinking. And I tried to hack the OpenSSL Ruby API by overriding the CERT_DIR (please don't kill me) to no avail. I'll try to follow the instructions you provided. Thank you

from riak-ruby-client.

Haha! Is CERT_DIR an environment variable? I don't believe we do anything in particular with it.

Please let me know if the instructions work: I'd like to reference the error more explicitly, or even wrap it in a friendlier error.

Also let me know if they don't work, for obvious reasons :)

from riak-ruby-client.

yes, SSL_CERT_DIR was an environment variable. Hacky, but it was a desperate attempt to narrow down the issue :)

Also, including a ca_file to point to ca-bundle (ca-certificates.crt file since I am on Ubuntu) did not work. Still getting the same error. Will continue looking into it. If you find something of interest, please let me know

from riak-ruby-client.

Can you extract the particular CA cert from the bundle?

from riak-ruby-client.

So I actually solved the problem.

Apparently in Riak config a CA File of its own was setup. Keep in mind that my app was living on a separate cluster than Riak. So I just scp'ed that CA file that was used in the config and passed it in as ca_file.

Either way, problem solved! And I feel a tad silly 😄

from riak-ruby-client.

Thanks for pointing out possible issues anyways!

Would some kind of diagnostic tool that could grab a server cert or some kind of cert data from Riak have been useful?

from riak-ruby-client.

Well, a more detailed error message would've been useful worst case :)

But that tool might save quite a bit of time as well. Especially if one is not a crypto expert.

from riak-ruby-client.

Fixed, or closed via GitHub issues.

[posted via JIRA by Alexander Moore]

from riak-ruby-client.