Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Occuring 'SSL Connection Error: ASN' if using rds-ca-2019 #4290

Closed
ikenji opened this issue Oct 25, 2019 · 4 comments
Closed

Occuring 'SSL Connection Error: ASN' if using rds-ca-2019 #4290

ikenji opened this issue Oct 25, 2019 · 4 comments

Comments

@ikenji
Copy link
Contributor

ikenji commented Oct 25, 2019

Issue Summary

I got the error below when upgrade rds-certificate and execute query on Redash.
Error running query: SSL connection error: ASN: bad other signature confirmation

I guess that occur because using RDS with rds-ca-2019.

I fixed that add key(*1) to 'redash/redash/query_runner/files/rds-combined-ca-bundle.pem' manually.
(*1) https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem

If this is right solution, may I create the pull-request?

refs:
AWS: Using SSL/TLS to Encrypt a Connection to a DB Instance
AWS: solution about SSL error

Steps to Reproduce

  1. Using RDS with rds-ca-2019.
  2. Executing some query on Redash console.

Technical details:

  • Redash Version:Redash 5.0.2+b5486
  • Browser/OS: Chrome Version 77.0.3865.120 / MacOS
  • How did you install Redash: AWS EC2 AMI redash-5.0.2-b5486-build2-ap-northeast-1
@arikfr
Copy link
Member

arikfr commented Oct 25, 2019

I guess that occur because using RDS with rds-ca-2019.

If the new certificates are optional, maybe we need to add support for both? Or is the 2019 one "backward compatible"?

@ikenji
Copy link
Contributor Author

ikenji commented Oct 28, 2019

@arikfr Thank you for your response.
One moment please, I will check it on my AWS environment using rds-ca-2015.

@ikenji
Copy link
Contributor Author

ikenji commented Oct 28, 2019

@arikfr

AWS support answers to me that need both of 2015 and 2019.

Please use rds-combined-ca-bundle.pem corresponding to both rds-ca-2015 and rds-ca-2019 when the DB instance settings are mixed during the transition period.
This is the same for both RDS and Aurora.

So, we should update 'rds-combined-ca-bundle.pem' from https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem not adding only rds-ca-2019.

May I create the Pull-Request that updating latest rds-combined-ca-bundle.pem?

@ikenji
Copy link
Contributor Author

ikenji commented Oct 28, 2019

Refs:

AWS announce "Rotating Your SSL/TLS Certificate"

Modify the DB instance to change the CA from rds-ca-2015 to rds-ca-2019.

https://docs.aws.amazon.com/en_pv/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html

ikenji added a commit to ikenji/redash that referenced this issue Oct 28, 2019
Can use rds-ca-2019 and etc
`$ curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem \
> redash/query_runner/files/rds-combined-ca-bundle.pem`
arikfr pushed a commit that referenced this issue Dec 5, 2019
Can use rds-ca-2019 and etc
`$ curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem \
> redash/query_runner/files/rds-combined-ca-bundle.pem`
@arikfr arikfr closed this as completed Feb 16, 2020
arikfr pushed a commit that referenced this issue Feb 16, 2020
Can use rds-ca-2019 and etc
`$ curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem \
> redash/query_runner/files/rds-combined-ca-bundle.pem`
arikfr added a commit that referenced this issue Feb 16, 2020
* Upgrade Snowflake connector

Backport to v8 branch of #4567 & #4407.

* Upgrade cassandra-driver to speed up Docker build.

Backport of #4636.

* Update rds-combined-ca-bundle.pem(#4290) (#4304)

Can use rds-ca-2019 and etc
`$ curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem \
> redash/query_runner/files/rds-combined-ca-bundle.pem`

* Update version.

* Update CHANGELOG.

Co-authored-by: Kenji Ichihashi <ichihashi@giftee.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants