Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail to verify SSL identity when recursing into a host with a different SSL cert #1259

Open
Hexcles opened this issue Mar 2, 2023 · 1 comment

Comments

@Hexcles
Copy link

Hexcles commented Mar 2, 2023

Here when gh-ost is recursively finding masters:

masterConfig = connectionConfig.Duplicate()

It copies the entire connectionConfig, including the private tlsConfig field:

tlsConfig: this.tlsConfig,

without updating its hostname:

ServerName: this.Key.Hostname,

Hence, it tries to connect to a new host likely with a different hostname and certificate, but still asks x509 to verify against the old hostname, which always fails:

x509: certificate is valid for [old hostname], not [newly found hostname]

@petervandoros
Copy link

We have hit this issue as well.

I spent some time and created a PR that resolves the issues described in this issue and confirmed it working:

#1487

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants