TLS authentication issue
These are the steps I have followed to set up TLS authentication from DBeaver to Vertica12:
- Create server private key
- Create server CA certificate - ca_cert
- Create self-signed server certificate - server_cert
- ALTER TLS CONFIGURATION server CERTIFICATE server_cert;
- ALTER TLS CONFIGURATION server TLSMODE 'ENABLE';
- CREATE AUTHENTICATION auth_record METHOD 'tls' HOST TLS '0.0.0.0/0';
- GRANT AUTHENTICATION auth_record TO PUBLIC;
- save ca_cert to a file and download it to the client
- use keytool.exe to add ca_cert to a keystore
- update dbeaver connection driver settings (tlsmode=verify-full, truststorepath, truststorepassword)
I end up getting
2025-02-17 06:18:23.068 Init Session:0x7f42557fd700 @v_xxxxxxxx_node0001: 00000/10712: TLS Authentication Failed for the user: dbadmin
2025-02-17 06:18:23.068 Init Session:0x7f42557fd700 @v_xxxxxxxx_node0001: 28000/6431: TLS authentication failed for user "dbadmin"
2025-02-17 06:18:23.068 Init Session:0x7f42557fd700 @v_xxxxxxxx_node0001: {SessionRun} 28000/2248: Authentication failed for username "dbadmin"
the problem is - it is not telling me much. Is there any way I can get more information about the error or do you see any apparent flaws in the steps above?
Update:
connecting using vsql from the vertica host looks like this:
[dbadmin@myhost ~]$ vsql
Welcome to vsql, the Vertica Analytic Database interactive terminal.
Type: \h or \? for help with vsql commands
\g or terminate with semicolon to execute query
\q to quit
SSL connection (cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, protocol: TLSv1.2)
Update2:
openssl s_client -tls1_2 -connect localhost:5433 CONNECTED(00000003) 139953380681616:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
Answers
@dimitri_p : Please enable logging at jdbc level and check jdbc driver logs.
Sadly I've tried that - it was just as useless as vertica.log. I don't remember exactly what it said, but something along the same lines as "tls authentication failed for user dbadmin" and a stacktrace.
please open a support case. we can review the issue on webex.
For those who found this trying to solve their issue, the solution was this:
change
CREATE AUTHENTICATION auth_record METHOD 'tls' HOST TLS '0.0.0.0/0';
to
CREATE AUTHENTICATION auth_record METHOD 'hash' HOST TLS '0.0.0.0/0';
ie from key to password based authentication under TLS