appsignal root CA is not trusted in the debian CA store

[neuronull]

A cert was added recently to the appsignal endpoint

**Monday, April 10, 2023 at 6:00:00 PM**

, and it appears that the root CA is not trusted in the debian CA store.

root@runner:/home/vector# update-ca-certificates
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@runner:/home/vector# curl https://appsignal-endpoint.net
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

The integration test has temporarily been disabled in CI until this issue is resolved (#17109)

Here are a couple approaches:

1. Have the root CA that issued this cert be added to the debian store
2. Incidentally, at this point in the code https://cs.github.com/vectordotdev/vector/blob/a791595b0cfcae36d0c46708a91d5e2813ed38eb/src/sinks/appsignal/mod.rs#L117 , we actually should be passing in user defined TLS settings. So one approach to addressing this issue is to add the TLS settings to the config settings for the sink, use those instead of &None , and pass in the root CA that issued this cert to tls.ca_file as part of the integration tests.

It seems like this might cause problems for other users of AppSignal though, independent of it's impact to the vector int test. So that might influence the decision.

cc @tombruijn , @thijsc . Would you guys be able to take ownership of this?

[thijsc]

We rolled out a reissued certificate today, something might have gone wrong there. We’re looking into this right away and will take ownership.

[thijsc]

We made a mistake with this rollout; we've just rolled out an updated configuration. This issue should be fixed now.

[neuronull]

Thanks for the quick turnaround on that!

[neuronull]

FYI- I opened #17112 , to separately track allowing user defined TLS settings in the sink.

[thijsc]

Can we close this one?

[neuronull]

Can we close this one?

Ah yes, closing. Thanks again.