-
Notifications
You must be signed in to change notification settings - Fork 111
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gen-pkcs12-keystore init container fails if the tls secret contains no ca.crt #684
Milestone
Comments
I will provide a pull request to include the -in ca.crt only if there is a ca.crt file present: Tested:
|
smoldenhauer-ish
added a commit
to intershop/solr-operator
that referenced
this issue
Feb 12, 2024
smoldenhauer-ish
added a commit
to intershop/solr-operator
that referenced
this issue
Feb 12, 2024
smoldenhauer-ish
added a commit
to intershop/solr-operator
that referenced
this issue
Apr 4, 2024
…e#684) * Apply suggestions from code review Co-authored-by: Houston Putman <houstonputman@gmail.com>
smoldenhauer-ish
added a commit
to intershop/solr-operator
that referenced
this issue
Apr 4, 2024
…e#684) * add e2e test generating keystore with init container
smoldenhauer-ish
added a commit
to intershop/solr-operator
that referenced
this issue
Apr 5, 2024
…e#684) * use -certfile option for ca.crt if present * add to changelog
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Configure the solrTLS with a TLS secret that contains only a tls.crt and a tls.key
It seems to be dependent on the issuer if there is a separate ca.crt or not e.g. see cert-manager/cert-manager#1571
The generated init container command
openssl pkcs12 -export -in /var/solr/tls/tls.crt -in /var/solr/tls/ca.crt -inkey /var/solr/tls/tls.key -out /var/solr/tls/pkcs12/keystore.p12 -passout pass:${SOLR_SSL_KEY_STORE_PASSWORD}
fails with
Can't open /var/solr/tls/ca.crt for reading, No such file or directory 139805662672192:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('/var/solr/tls/ca.crt','r') 139805662672192:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76:
However if the keystore is generated with the tls.crt and tls.key as input it works. (The tls.crt contains the full chain of certificates)
The text was updated successfully, but these errors were encountered: