FelisOrion
Connecting to Cassandra using SSL
Hi everyone, I’m struggling to connect to Cassandra using SSL. Currently I’m trying elixir librari xandra witch seams to have this option but I can’t figure out how to do so. Documentation is not so clear about ssl option.
My connection code looking like this:
{:ok, pid} = Xandra.start_link(nodes: ["cassandra.eu-central-1.amazonaws.com:9142"], encryption: true, transport_options: [certificate: "AmazonRootCA1.pem"], authentication: {Xandra.Authenticator.Password, options})
As error i got this message:
[error] ... action "TCP connect" failed with reason: {:options, {:keyfile, 'AmazonRootCA1.pem', []}}
Does I’m doing something wrong?
If someone have any clue how to connect to Cassandra please give me some hints.
Thank you all
Marked As Solved
voltone
The :versions option should not really affect the certificate chain verification.
I believe the ‘unknown CA’ error happens because Amazon’s root CA is a cross-signed CA certificate, and the chain the server is sending includes the cross-signed intermediate version that was signed by another root CA. Such configurations are not very well supported by the :ssl application.
You can fix this by creating a CA store that includes both the Amazon root CA (from your current AmazonRootCA1.pem file) and the ‘/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority’ certificate (see below). Then update the :cacertfile option to point to that new file with both certs. That should work both with Amazon’s current configuration and in the future once they remove the cross-signing CAs and rely only on their own root CA.
During testing keep in mind that :ssl enables session reuse by default, meaning connections to a specific server will skip the TLS handshake if a prior connection to that server can be resumed. In that case, and new ssl options you passed will simply be ignored. If you restart your application every time this is not an issue, but it can bite you when trying things in iEX.
-----BEGIN CERTIFICATE-----
MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl
MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp
U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw
NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE
ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp
ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3
DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf
8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN
+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0
X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa
K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA
1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G
A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR
zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0
YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBD
bGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8w
DQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGsafPzWdqbAYcaT1epoXkJKtv3
L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLMPUxA2IGvd56D
eruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl
xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp
VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY
WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q=
-----END CERTIFICATE-----
Also Liked
voltone
Disclaimer: I have not used Cassandra or Xandra myself.
I would start by enabling encryption without any ssl options, just to see that the transport layer works. So encryption: true, transport_options: []. Assuming Xandra does not override any of the ssl options, this would establish a TLS connection, but without verifying the server’s certificate.
Once that is working I would set transport_options: [verify: :verify_peer, cacertfile: 'AmazonRootCA1.pem']. This will likely fail, because some further options are typically needed for AWS servers, but at least it should attempt the handshake. If instead this results in errors about the CA certificate, there may be a problem locating or reading the CA certificate file.
If the handshake results in ‘depth’ errors, because AWS servers tend to have a long certificate chain, add depth: 2 or depth: 3 so the ssl options (the default value is 1).
If you see errors about hostname verification, add customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)], to improve handling of wildcard certificates.
FelisOrion
Roger that, thank you so much for explanation and your time. I will try to do as you said.
Have a wonderful day and stay safe!
Popular in Questions
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
Practical resources that improve the lives of professional developers. By developers, for developers.
Categories:
Sub Categories:
Forums
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
Courses that'll move you from confusion to "Aha, now I get it!"