{"action":"created","issue":{"url":"https://api.github.com/repos/zalando/patroni/issues/298","repository_url":"https://api.github.com/repos/zalando/patroni","labels_url":"https://api.github.com/repos/zalando/patroni/issues/298/labels{/name}","comments_url":"https://api.github.com/repos/zalando/patroni/issues/298/comments","events_url":"https://api.github.com/repos/zalando/patroni/issues/298/events","html_url":"https://github.com/zalando/patroni/issues/298","id":176652398,"number":298,"title":"SSL handshake failure","user":{"login":"maximegaillard","id":545492,"avatar_url":"https://avatars.githubusercontent.com/u/545492?v=3","gravatar_id":"","url":"https://api.github.com/users/maximegaillard","html_url":"https://github.com/maximegaillard","followers_url":"https://api.github.com/users/maximegaillard/followers","following_url":"https://api.github.com/users/maximegaillard/following{/other_user}","gists_url":"https://api.github.com/users/maximegaillard/gists{/gist_id}","starred_url":"https://api.github.com/users/maximegaillard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maximegaillard/subscriptions","organizations_url":"https://api.github.com/users/maximegaillard/orgs","repos_url":"https://api.github.com/users/maximegaillard/repos","events_url":"https://api.github.com/users/maximegaillard/events{/privacy}","received_events_url":"https://api.github.com/users/maximegaillard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-13T14:16:15Z","updated_at":"2016-09-14T08:29:27Z","closed_at":null,"body":"**Patroni Version:**\r\n\r\n1.0\r\n\r\n**Steps to Reproduce:**\r\n\r\nI'm trying to build a Postgresql cluster with Patroni (if you want to know, on top of https://github.com/rancher/rancher). I've got 3 Postgresql nodes, one Etcd container, and a HAproxy loadbalancer.\r\n\r\nI can access Postgresql through the no-ssl port (1111), but through the SSL port I can't : my `psql` command ends up stalling.\r\n\r\nAccording to the HAProxy logs, the issue is an `SSL Handshake failure` :\r\n`Sep  9 09:39:37 localhost haproxy[1132]: xx.xx.xx.xx:55815 [09/Sep/2016:09:39:17.275] e54cf7f6-9f4a-4487-87a3-aa3adb340ad2_5432_frontend/1: SSL handshake failure`\r\n\r\nThe strange thing is, I can access it with openssl\r\n\r\n```\r\nopenssl s_client -connect FQDN:5432\r\nCONNECTED(00000003)\r\ndepth=1 /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3\r\nverify error:num=20:unable to get local issuer certificate\r\nverify return:0\r\n---\r\nCertificate chain\r\n 0 s:/CN=FQDN\r\n   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3\r\n 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3\r\n   i:/O=Digital Signature Trust Co./CN=DST Root CA X3\r\n---\r\nServer certificate\r\n-----BEGIN CERTIFICATE-----\r\nXXX\r\n-----END CERTIFICATE-----\r\nsubject=/CN=FQDN\r\nissuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3\r\n---\r\nNo client certificate CA names sent\r\n---\r\nSSL handshake has read 3442 bytes and written 456 bytes\r\n---\r\nNew, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA\r\nServer public key is 2048 bit\r\nSecure Renegotiation IS supported\r\nCompression: NONE\r\nExpansion: NONE\r\nSSL-Session:\r\n    Protocol  : TLSv1\r\n    Cipher    : DHE-RSA-AES128-SHA\r\n    Session-ID: 3D637AAFDBA43D1021A9F083AAE54E8940F048E6210AC4DE313A5FA031DA38C6\r\n    Session-ID-ctx:\r\n    Master-Key: EABBC21601CC27E6259678A03B30E882E3AA182C12D71B47C8FD8AE69DA039F020B7FD19EF18DF85E5FAEDA96C29842B\r\n    Key-Arg   : None\r\n    Start Time: 1473407829\r\n    Timeout   : 300 (sec)\r\n    Verify return code: 0 (ok)\r\n---\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/zalando/patroni/issues/comments/246942292","html_url":"https://github.com/zalando/patroni/issues/298#issuecomment-246942292","issue_url":"https://api.github.com/repos/zalando/patroni/issues/298","id":246942292,"user":{"login":"CyberDem0n","id":3407345,"avatar_url":"https://avatars.githubusercontent.com/u/3407345?v=3","gravatar_id":"","url":"https://api.github.com/users/CyberDem0n","html_url":"https://github.com/CyberDem0n","followers_url":"https://api.github.com/users/CyberDem0n/followers","following_url":"https://api.github.com/users/CyberDem0n/following{/other_user}","gists_url":"https://api.github.com/users/CyberDem0n/gists{/gist_id}","starred_url":"https://api.github.com/users/CyberDem0n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CyberDem0n/subscriptions","organizations_url":"https://api.github.com/users/CyberDem0n/orgs","repos_url":"https://api.github.com/users/CyberDem0n/repos","events_url":"https://api.github.com/users/CyberDem0n/events{/privacy}","received_events_url":"https://api.github.com/users/CyberDem0n/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T08:29:27Z","updated_at":"2016-09-14T08:29:27Z","body":"> Are you saying I can't do SSL offloading (have an SSL traffic between the client and HAProxy and a clear traffic between HAProxy and DB nodes?) with HAProxy.\r\n\r\nYep, HAProxy works perfectly for http(s) protocol, but it looks like it doesn't support \"pgsql\" protocol.\r\n\r\n> and I have to use stunnel (or directly configure SSL on my Postgres nodes) ?\r\n\r\nI just gave stunnel as an example, because it can deal with the \"pgsql\" handshake.\r\nIf you put stunnel in front of HAProxy it will work (I mean it will do SSL offloading for you), but I think it is better to have certificates directly on the postgres nodes."}}
{"actor":{"display_login":"CyberDem0n"}}