# Facing issue with TLS Setup

**URL:** <https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463>\
**Category:** Using FoundationDB\
**Created:** [June 18, 2019, 2:18pm UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463 "2019-06-18T14:18:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sakthivelpvs](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@sakthivelpvs](https://forums.foundationdb.org/u/sakthivelpvs)\
**Post date:** [June 18, 2019, 2:18pm UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463/1 "2019-06-18T14:18:59Z")

</div>

I have tried following [TLS Link](https://apple.github.io/foundationdb/tls.html) to setup TLS based setup. But, whenever I configure TLS related configs in foundationdb.conf, following error is displayed in status of foundationdb service,

> LogGroup=“default” Process=“fdbserver.4500”: Error: File could not be read  
> Jun 18 19:32:32 aximsoft-Lenovo-B51-80 fdbmonitor[12064]: LogGroup=“default” Process=“fdbserver.4500”: Process 12103 exited 10, restarting in 0 seconds

My setup details

Cluster File

> dg4oKUbk:27624DC1@127.0.0.1:4500:tls

Foundationdb.conf File

> [fdbmonitor]  
> user = foundationdb  
> group = foundationdb
> 
> [general]  
> restart\_delay = 60  
> cluster\_file = /etc/foundationdb/fdb.cluster
> 
> [fdbserver]  
> command = /usr/sbin/fdbserver  
> public\_address = auto:$ID:tls  
> listen\_address = public  
> datadir = /var/lib/foundationdb/data/$ID  
> logdir = /var/log/foundationdb  
> tls\_certificate\_file=/root/certs/fdb.pem  
> tls\_key\_file=/root/certs/private.key  
> #tls\_verify\_peers=Check.Valid=0  
> tls\_ca\_file = /root/certs/cert.crt
> 
> [fdbserver.4500]

Its working, when I run manually fdbserver process with command line options. But, facing issue only when I run as foundationdb service.

---

<div class="post-metadata">

**Author:** ![alexmiller](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/alexmiller/32/326_2.png) [@alexmiller](https://forums.foundationdb.org/u/alexmiller)\
**Post date:** [June 18, 2019, 5:22pm UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463/2 "2019-06-18T17:22:55Z")

</div>

Can you paste us the output of `ls -l /root/certs/private.key /root/certs/fdb.pem` ?

I’m going to bet that your keys are only readable by root, and the FoundationDB service is run as `foundationdb`, so it can no longer read your keys.

---

<div class="post-metadata">

**Author:** ![sakthivelpvs](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@sakthivelpvs](https://forums.foundationdb.org/u/sakthivelpvs)\
**Post date:** [June 19, 2019, 6:26am UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463/3 "2019-06-19T06:26:56Z")

</div>

@alexmiller, read access is there for all users. please check file permission as follows,

> $ ls -l /root/certs/private.key /root/certs/fdb.pem  
> -rw-r–r-- 1 root root 2933 Jun 18 17:09 /root/certs/fdb.pem  
> -rw-r–r-- 1 root root 1704 Jun 18 17:08 /root/certs/private.key

I will cross verify certificate permissions by creating new certs.

---

<div class="post-metadata">

**Author:** ![senthil](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/senthil/32/720_2.png) [@senthil](https://forums.foundationdb.org/u/senthil)\
**Post date:** [June 20, 2019, 7:06am UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463/4 "2019-06-20T07:06:04Z")

</div>

@sakthivelpvs Please check whether the directory /root/certs also has the same permission as the file.

---

<div class="post-metadata">

**Author:** ![sakthivelpvs](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@sakthivelpvs](https://forums.foundationdb.org/u/sakthivelpvs)\
**Post date:** [June 21, 2019, 7:46am UTC](https://forums.foundationdb.org/t/facing-issue-with-tls-setup/1463/5 "2019-06-21T07:46:38Z")

</div>

@senthil Its working now. Issue with root folder permission. Thanks.