Facing issue with TLS Setup

Using FoundationDB
1

I have tried following TLS Link to setup TLS based setup. But, whenever I configure TLS related configs in foundationdb.conf, following error is displayed in status of foundationdb service,

LogGroup=“default” Process=“fdbserver.4500”: Error: File could not be read
Jun 18 19:32:32 aximsoft-Lenovo-B51-80 fdbmonitor[12064]: LogGroup=“default” Process=“fdbserver.4500”: Process 12103 exited 10, restarting in 0 seconds

My setup details

Cluster File

dg4oKUbk:27624DC1@127.0.0.1:4500:tls

Foundationdb.conf File

[fdbmonitor]
user = foundationdb
group = foundationdb

[general]
restart_delay = 60
cluster_file = /etc/foundationdb/fdb.cluster

[fdbserver]
command = /usr/sbin/fdbserver
public_address = auto:$ID:tls
listen_address = public
datadir = /var/lib/foundationdb/data/$ID
logdir = /var/log/foundationdb
tls_certificate_file=/root/certs/fdb.pem
tls_key_file=/root/certs/private.key
#tls_verify_peers=Check.Valid=0
tls_ca_file = /root/certs/cert.crt

[fdbserver.4500]

Its working, when I run manually fdbserver process with command line options. But, facing issue only when I run as foundationdb service.

2

Can you paste us the output of ls -l /root/certs/private.key /root/certs/fdb.pem ?

I’m going to bet that your keys are only readable by root, and the FoundationDB service is run as foundationdb, so it can no longer read your keys.

3

@alexmiller, read access is there for all users. please check file permission as follows,

$ ls -l /root/certs/private.key /root/certs/fdb.pem
-rw-r–r-- 1 root root 2933 Jun 18 17:09 /root/certs/fdb.pem
-rw-r–r-- 1 root root 1704 Jun 18 17:08 /root/certs/private.key

I will cross verify certificate permissions by creating new certs.

4

@sakthivelpvs Please check whether the directory /root/certs also has the same permission as the file.

1 Like
5

@senthil Its working now. Issue with root folder permission. Thanks.