Client not trusting server certificate are logged using the "error" log level

[kobelb]

We presently only downgrade selective client errors from the "error" level to the "info" level here. We aren't presently downgrading TLS/SSL errors, so when a client connects to Kibana and doesn't trust the certificate, the following is logged:

[18:22:31.675] [error][client][connection] Error: 4443837888:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/s3_pkt.c:1498:SSL alert number 46

This is just an example of the type of errors that we log, they're numerous and I'm not seeing a way to classify them easily off-hand besides using a regex, or changing the way in which Hapi classifies all tls errors as client connection errors.

[elasticmachine]

Pinging @elastic/kibana-operations

[seiddegu]

@kobelb ,

Is there any config directive to set to some level, to surpass this error ?

Regards;

[elasticmachine]

Pinging @elastic/kibana-platform (Team:Platform)

[jbudz]

Adding platform, mostly to cc.

[peter-wang-wsl]

can this log non-display by import .p12 file into browser?

[Leaf-Lin]

Can we reduce the severity of this from error to info?

[lukeelmers]

@kobelb Grooming through old issues, and it looks like we had labeled this issue as impact:high, but I'm not certain if that's accurate. In your opinion, do you feel this is a high-impact bug?

[kobelb]

@kobelb Grooming through old issues, and it looks like we had labeled this issue as impact:high, but I'm not certain if that's accurate. In your opinion, do you feel this is a high-impact bug?

IMO, it's more of a medium impact issue. It's likely a considerable annoyance in a number of situations. For example, if anyone is using Kibana's server logs to monitor the number of errors that are thrown, this will skew these numbers because an incorrect logging level is used. Additionally, I've anecdotally sent developers down the path of thinking that Kibana is doing something wrong, when it's really something that the "client" is doing wrong.

[TinaHeiligers]

they're numerous and I'm not seeing a way to classify them easily off-hand besides using a regex
@kobelb, I'm going through logs of these where I can find them to see the variation between the errors.

Would a regex such as /ssl3_read_bytes:sslv3/ be a good match?