# TLS implemenation for foundationdb

**URL:** <https://forums.foundationdb.org/t/tls-implemenation-for-foundationdb/3503>\
**Category:** Using FoundationDB\
**Created:** [August 17, 2022, 4:16pm UTC](https://forums.foundationdb.org/t/tls-implemenation-for-foundationdb/3503 "2022-08-17T16:16:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gvddk](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gvddk](https://forums.foundationdb.org/u/gvddk)\
**Post date:** [August 17, 2022, 4:16pm UTC](https://forums.foundationdb.org/t/tls-implemenation-for-foundationdb/3503/1 "2022-08-17T16:16:01Z")

</div>

We have implemented TLS in our fdb cluster using self signed certificates. Even the clients can able to connect with the cluster using tls certs and can able to write the data. By using below command, we can able to connect to fdbcli using the certs.

fdbcli --tls\_ca\_file /etc/foundationdb/pki/ca.crt --tls\_certificate\_file /etc/foundationdb/pki/client-server.crt --tls\_key\_file /etc/foundationdb/pki/client-server.key --tls\_verify\_peers Check.Valid=0

fdb server version:  
FoundationDB 7.1 (v7.1.5)

By using below modules in ansible, we have generated self signed certificates.

community.crypto.openssl\_privatekey:  
community.crypto.x509\_certificate:  
community.crypto.openssl\_privatekey:  
community.crypto.openssl\_csr\_pipe:

Issue:  
In the foundationdb logs, we noticed that below traces are keep on generating with TLS failures.

Event Severity=“10” Time=“1660736446.267173” DateTime=“2022-08-17T11:40:46Z” Type=“IncomingConnectionError” ID=“26ae06d3d759554e” Error=“connection\_failed” ErrorDescription=“Network connection failed” ErrorCode=“1026” SuppressedEventCount=“4” FromAddress=“xxxxxxxx:57414:tls” ThreadID=“7499685985715584756” Machine=“10.23.216.10:4500” LogGroup=“default” /

Event Severity=“20” Time=“1660736447.498181” DateTime=“2022-08-17T11:40:47Z” Type=“N2\_AcceptHandshakeError” ID=“0000000000000000” ErrorCode=“336151576” ErrorMsg=“tlsv1 alert unknown ca (SSL routines, ssl3\_read\_bytes)” BackgroundThread=“1” ThreadID=“1547189418734296536” Machine=“xxxxxxx:4500” LogGroup=“default” /

what could be the issue? Please let us know the fix for this.

---

<div class="post-metadata">

**Author:** ![alexmiller](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/alexmiller/32/326_2.png) [@alexmiller](https://forums.foundationdb.org/u/alexmiller)\
**Post date:** [August 17, 2022, 7:55pm UTC](https://forums.foundationdb.org/t/tls-implemenation-for-foundationdb/3503/2 "2022-08-17T19:55:08Z")

</div>

It’s trying to tell you that the accepting process doesn’t recognize the certificate that the client is presenting. You’ll need to match that up on the client and server side to understand why that’s the case.

If you add `--debug-tls` to your fdbcli invocation, it’ll print out the certificates passed in with the rest of the arguments, which can make the process a bit simpler.

---

<div class="post-metadata">

**Author:** ![gvddk](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gvddk](https://forums.foundationdb.org/u/gvddk)\
**Post date:** [August 18, 2022, 4:03am UTC](https://forums.foundationdb.org/t/tls-implemenation-for-foundationdb/3503/3 "2022-08-18T04:03:11Z")

</div>

> [@alexmiller](#):
>
> –debug-tls

Thanks for your prompt reply. we faced couple of issues with our certs then finally fixed it.

Issue 1:  
While doing the cert validation with below command, we got the error as verification failed. So we recreated the certs and copied in the required path.  
openssl verify -CAfile /etc/foundationdb/pki/ca.crt /etc/foundationdb/pki/client-server.crt

Issue 2:  
Even after changing the certs in foundationdb VM, still we noticed few TLS failure lines in the fdb logs.

1. In the fdb configuration file, we have multiple sections for the fdb daemons like [fdbserver], [backup-agent] etc…  
2)In the configuration file, fdbserver section as below TLS parameters but backup-agent section doesn’t have that parameters.  
[fdbserver]  
tls\_certificate\_file = /etc/foundationdb/pki/client-server.crt  
tls\_key\_file = /etc/foundationdb/pki/client-server.key  
tls\_ca\_file = /etc/foundationdb/pki/ca.crt  
tls\_verify\_peers = Check.Valid=0

2. Since the TLS parameters are missing in the backup-agent section, the backup daemon is throwing the failure logs in the trace files.

3. After adding the above TLS parameters, i don’t see any failures