Issue enabling TLS for DAML JSON Api

senrav
Wed, 12 Aug 2020 12:29:03 +0000
App Development

I’m running DAML JSON Api and DAML on SQL process as two different pods in a kubernetes cluster. Trying to enable TLS communication using self signed certs for both the processes.

Following commands to generate the certs,

openssl genrsa -out ca.key 4096
openssl req -new -x509 -key ca.key -out ca.crt -subj '/CN=[0.0.0.0.ca](http://0.0.0.0.ca/)' -days 3650#
Generate server key, csr and crt
openssl genrsa -out daml-on-sql.key 4096
openssl pkey -in daml-on-sql.key -out daml-on-sql.pem
openssl req -new -key daml-on-sql.key -out daml-on-sql.csr -subj '/CN=0.0.0.0.server'
openssl x509 -req -in daml-on-sql.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out daml-on-sql.crt -extfile openssl-extensions.cnf -extensions req_ext -days 3650# Generate client key, csr and crt

openssl genrsa -out daml-json-api.key 4096
openssl pkey -in daml-json-api.key -out daml-json-api.pem
openssl req -new -key daml-json-api.key -out daml-json-api.csr -subj '/CN=0.0.0.0.client'
openssl x509 -req -in daml-json-api.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out daml-json-api.crt -extfile openssl-extensions.cnf -extensions req_ext -days 3650

Added the kubernetes service name of daml-on-sql process as a subject alternative name in the extensions file while creating the certs.

Have set the cert path, pem path and ca cert path for the containers in the deployment yaml.

The DAML on sql is running fine as per the logs below,

INFO: Listening on 0.0.0.0:6865 over TLS. (context: {participantId=sandbox-participant})
INFO: Initialized sandbox version 1.2.0 with ledger-id = yyy, port = 6865, dar file = List(yyy.dar), time mode = wall-clock time, ledger = postgres, auth-service = AuthServiceWildcard$, contract ids seeding = strong

The DAML JSON seems to have started ok, and it has loaded the existing package id’s as well,

11:45:09.314 [http-json-ledger-api-akka.actor.default-dispatcher-9] INFO com.daml.http.Main$ - Started server: ServerBinding(/0.0.0.0:7575)

But the issue is I’m unable to access the endpoint using https.

When I run a curl command inside the container, I get the below error

curl -v https://localhost:7575/v1/query
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 7575 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Curl_http_done: called premature == 1
* stopped the pause stream!
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Also I see the below warning in the JSON Api logs,

[WARN] [08/12/2020 11:45:53.610] [http-json-ledger-api-akka.actor.default-dispatcher-8] [akka.actor.ActorSystemImpl(http-json-ledger-api)] Illegal request, responding with status '400 Bad Request': Unsupported HTTP method: The HTTP method started with 0x16 rather than any known HTTP method. Perhaps this was an HTTPS request sent to an HTTP endpoint?

10 posts - 6 participants