#924005 client certificate verification regression with puppetdb

Package:
jetty9
Source:
jetty9
Submitter:
"Stefan Bühler"
Date:
2024-11-02 11:39:03 UTC
Severity:
normal
Tags:
#924005#5
Date:
2019-03-08 08:59:14 UTC
From:
To:
Hi.

The update (libjetty9-java and libjetty9-extra-java) to 9.4.15-1 broke
our puppetdb setup; a downgrade to 9.4.14-1 fixes the issue.

I can't see any (new/useful/related) error message in the puppetdb log.

The error message from our puppetmaster is:

Error connecting to puppet-db.XXX on 8081 at route /pdb/cmd/v1?..., error message received was 'SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown'. Failing over to the next PuppetDB server_url in the 'server_urls' list

openssl s_client -quiet ... shows:
---
depth=1 CN = Puppet CA: puppetmaster.XXX
verify return:1
depth=0 CN = puppet-db.XXX
verify return:1
139863914905664:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../ssl/record/rec_layer_s3.c:1407:SSL alert number 46
---

(The same s_client call works with a jetty downgrade to 9.4.14-1, so the
client certificate arguments should be good.)
---
Installed jetty and puppet packages:
ii  libjetty9-extra-java                      9.4.15-1     all          Java servlet engine and webserver -- extra libraries
ii  libjetty9-java                            9.4.15-1     all          Java servlet engine and webserver -- core libraries
ii  libtrapperkeeper-webserver-jetty9-clojure 1.7.0-2      all          trapperkeeper webserver service
ii  libpuppetlabs-http-client-clojure         0.9.0-1      all          Clojure wrapper around libhttpasyncclient-java
ii  libpuppetlabs-i18n-clojure                0.8.0-1      all          Clojure i18n library
ii  libpuppetlabs-ring-middleware-clojure     1.0.0-2      all          common Ring middleware for Puppet projects
ii  puppet                                    5.5.10-1     all          configuration management system
ii  puppetdb                                  6.2.0-3      all          Puppet data warehouse
---

cheers,
Stefan
#924005#10
Date:
2019-03-31 13:59:19 UTC
From:
To:
I had the same problem, and I found this bug when searching for a
solution.

I downgraded to the previous jetty version from snapshots.debian.org and
it worked.

I'm unsure what changed in this version that causes it.
#924005#19
Date:
2019-06-15 15:27:45 UTC
From:
To:
Hi,

I noticed that I also have this problem and managed to solve it by patching the
libtrapperkeeper-webserver-jetty9-clojure package with a commit [1] from a
branch that was recently merged into the upstream
trapperkeeper-webserver-jetty9-clojure repo. In the meantime, I've created a
bug report against libtrapperkeeper-webserver-jetty9-clojure [2] with a patch
that includes this upstream patch.

Kind regards
Manfred


[1] https://github.com/puppetlabs/trapperkeeper-webserver-jetty9/commit/9db4170381e07165078e544340e12b38676c2613
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930562
#924005#30
Date:
2021-10-18 09:41:03 UTC
From:
To:
Control: severity -1 normal
message received was 'SSL_connect returned=1 errno=0 state=error: sslv3 alert
certificate unknown'. Failing over to the next PuppetDB server_url in the
'server_urls' list

[...]

As Manfred Stock in this bug report has already mentioned, the breakage was
caused by a change in Jetty 9.4.15 which disabled Endpoint Identification by
default and the switch to HTTPS. This apparently caused a problem with Puppet.
To me it seems this is merely a configuration problem on the Puppet side and a
workaround exists. I leave this bug report open for future reference but I feel
there is nothing what we can do to improve the situation in Buster from the
Jetty point of view.

Markus