etcd certificate validation failure on trixie
ActivePublic
Actions

Authored by Scott_French on Fri, Oct 2, 2:47 PM.

Project Tags

None

Referenced Files

	F105847961: etcd certificate validation failure on trixie
	Fri, Oct 2, 2:47 PM

Subscribers

None

	swfrench@deploy1003:~$ lsb_release -c
	Codename: bookworm
	swfrench@deploy1003:~$ python3
	Python 3.11.2 (main, May 12 2026, 05:17:27) [GCC 12.2.0] on linux
	Type "help", "copyright", "credits" or "license" for more information.
	>>> import etcd
	>>> c = etcd.Client(protocol="https", srv_domain="conftool.eqiad.wmnet", allow_reconnect=True)
	>>> c.read("/")
	<class 'etcd.EtcdResult'>({'action': 'get', 'key': None, 'value': None, 'expiration': None, 'ttl': None, 'modifiedIndex': None, 'createdIndex': None, 'newKey': False, 'dir': True, '_children': [{'key': '/conftool', 'dir': True, 'modifiedIndex': 17, 'createdIndex': 17}, {'key': '/spicerack', 'dir': True, 'modifiedIndex': 3148843, 'createdIndex': 3148843}], 'etcd_index': 3929439, 'raft_index': 74582072066})
	>>>

	# switch hosts

	swfrench@cumin2003:~$ lsb_release -c
	Codename: trixie
	swfrench@cumin2003:~$ python3
	Python 3.13.5 (main, Jul 15 2026, 20:25:40) [GCC 14.2.0] on linux
	Type "help", "copyright", "credits" or "license" for more information.
	>>> import etcd
	>>> c = etcd.Client(protocol="https", srv_domain="conftool.eqiad.wmnet", allow_reconnect=True, ca_cert="/etc/ssl/certs/wmf-ca-certificates.crt")
	>>> c.read("/")
	<class 'etcd.EtcdResult'>({'action': 'get', 'key': None, 'value': None, 'expiration': None, 'ttl': None, 'modifiedIndex': None, 'createdIndex': None, 'newKey': False, 'dir': True, '_children': [{'key': '/spicerack', 'dir': True, 'modifiedIndex': 3148843, 'createdIndex'
	: 3148843}, {'key': '/conftool', 'dir': True, 'modifiedIndex': 17, 'createdIndex': 17}], 'etcd_index': 3929487, 'raft_index': 74583209711})
	>>>
	>>> c = etcd.Client(protocol="https", srv_domain="conftool.eqiad.wmnet", allow_reconnect=True)
	Traceback (most recent call last):
	File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 510, in wrap_socket
	cnx.do_handshake()
	~~~~~~~~~~~~~~~~^^
	File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 2373, in do_handshake
	self._raise_ssl_error(self._ssl, result)
	~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
	File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1990, in _raise_ssl_error
	_openssl_assert(
	~~~~~~~~~~~~~~~^
	reason == _lib.SSL_R_UNEXPECTED_EOF_WHILE_READING
	^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	)
	^
	File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 76, in openssl_assert
	exception_from_error_queue(error)
	~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
	File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 62, in exception_from_error_queue
	raise exception_type(errors)
	OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')]

	[ ... snip ... ]

Event Timeline

Scott_French created this paste.Fri, Oct 2, 2:47 PM

Scott_French mentioned this in T440009: etcd client fails on debian trixie with urllib3.exceptions.SSLError when appropriate CA certs are not provided.Fri, Oct 2, 4:28 PM

etcd certificate validation failure on trixieActivePublicActions

Event Timeline

etcd certificate validation failure on trixie
ActivePublic
Actions