{"action":"created","issue":{"url":"https://api.github.com/repos/cockroachdb/cockroach/issues/27450","repository_url":"https://api.github.com/repos/cockroachdb/cockroach","labels_url":"https://api.github.com/repos/cockroachdb/cockroach/issues/27450/labels{/name}","comments_url":"https://api.github.com/repos/cockroachdb/cockroach/issues/27450/comments","events_url":"https://api.github.com/repos/cockroachdb/cockroach/issues/27450/events","html_url":"https://github.com/cockroachdb/cockroach/issues/27450","id":340805570,"node_id":"MDU6SXNzdWUzNDA4MDU1NzA=","number":27450,"title":"Node communication issues using 3rd party certificates","user":{"login":"josephmiano","id":38541857,"node_id":"MDQ6VXNlcjM4NTQxODU3","avatar_url":"https://avatars3.githubusercontent.com/u/38541857?v=4","gravatar_id":"","url":"https://api.github.com/users/josephmiano","html_url":"https://github.com/josephmiano","followers_url":"https://api.github.com/users/josephmiano/followers","following_url":"https://api.github.com/users/josephmiano/following{/other_user}","gists_url":"https://api.github.com/users/josephmiano/gists{/gist_id}","starred_url":"https://api.github.com/users/josephmiano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josephmiano/subscriptions","organizations_url":"https://api.github.com/users/josephmiano/orgs","repos_url":"https://api.github.com/users/josephmiano/repos","events_url":"https://api.github.com/users/josephmiano/events{/privacy}","received_events_url":"https://api.github.com/users/josephmiano/received_events","type":"User","site_admin":false},"labels":[{"id":933199214,"node_id":"MDU6TGFiZWw5MzMxOTkyMTQ=","url":"https://api.github.com/repos/cockroachdb/cockroach/labels/A-core-security","name":"A-core-security","color":"c2e0c6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-07-12T21:31:07Z","updated_at":"2018-07-18T20:34:35Z","closed_at":null,"author_association":"NONE","body":"Issue/Bug/Question\r\n\r\nSummary:\r\nWe are using our own certificate authority to create certificates for our Cockroach cluster build.  After creating the certificates, we are experiencing communication issues when attempting to start the cluster. Port communication on 26257 between the nodes does not seem to be an issues since we can telnet after starting the service.  We also verified the node.crt and client.root.crt files against the ca.crt and they return valid.\r\n\r\nSteps to reproduce:\r\nCreated node.crt and client.root.crt using a third party CA.\r\nStarted cockroach on all 3 nodes\r\n\r\nResults Expected:\r\nCluster communication between nodes to be successful.\r\n\r\nResults Occured:\r\nCluster will not start. Following message is returned: WARNING: The server appears to be unable to contact the other nodes in the cluster.\r\n\r\nLogs: \r\nLogs are attached.\r\n[cockroach-10.log](https://github.com/cockroachdb/cockroach/files/2190368/cockroach-10.log)\r\n[cockroach-20.log](https://github.com/cockroachdb/cockroach/files/2190369/cockroach-20.log)\r\n[cockroach-30.log](https://github.com/cockroachdb/cockroach/files/2190370/cockroach-30.log)\r\n\r\nVersion:\r\nBuild Tag:    v2.0.2\r\nBuild Time:   2018/05/21 14:55:20\r\nDistribution: CCL\r\nPlatform:     linux amd64 (x86_64-unknown-linux-gnu)\r\nGo Version:   go1.10\r\nC Compiler:   gcc 6.3.0\r\nBuild SHA-1:  fa2b2bfd802ebe8150030a14b0a36c25fef90b91\r\nBuild Type:   release\r\n\r\nCertificate Validation:\r\nopenssl verify -CAfile ca.crt node.crt\r\nnode.crt: OK\r\nopenssl verify -CAfile ca.crt client.root.crt\r\nclient.root.crt: OK"},"comment":{"url":"https://api.github.com/repos/cockroachdb/cockroach/issues/comments/406065274","html_url":"https://github.com/cockroachdb/cockroach/issues/27450#issuecomment-406065274","issue_url":"https://api.github.com/repos/cockroachdb/cockroach/issues/27450","id":406065274,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjA2NTI3NA==","user":{"login":"mberhault","id":5901480,"node_id":"MDQ6VXNlcjU5MDE0ODA=","avatar_url":"https://avatars3.githubusercontent.com/u/5901480?v=4","gravatar_id":"","url":"https://api.github.com/users/mberhault","html_url":"https://github.com/mberhault","followers_url":"https://api.github.com/users/mberhault/followers","following_url":"https://api.github.com/users/mberhault/following{/other_user}","gists_url":"https://api.github.com/users/mberhault/gists{/gist_id}","starred_url":"https://api.github.com/users/mberhault/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mberhault/subscriptions","organizations_url":"https://api.github.com/users/mberhault/orgs","repos_url":"https://api.github.com/users/mberhault/repos","events_url":"https://api.github.com/users/mberhault/events{/privacy}","received_events_url":"https://api.github.com/users/mberhault/received_events","type":"User","site_admin":false},"created_at":"2018-07-18T20:34:35Z","updated_at":"2018-07-18T20:34:35Z","author_association":"CONTRIBUTOR","body":"You're specifying an IP address in `--host`, which means this will be the advertised address (the one other nodes use to reach this one). Given that, it **has** to be in the certificate or it won't be verified. You can leave `--host` out and set `--advertise-host` to a DNS name resolvable (and reachable) from all other hosts."}}
{"actor":{"display_login":"mberhault"}}