I have some problem with TLS. Maybe I’m somewhere wrong.
For TLS I use this steps:
openssl genrsa -out dgraph-private.key -aes256
openssl req -x509 -new -extensions v3_ca -key dgraph-private.key -days 36500 -out dgraph-CA-cert.crt
openssl req -new -nodes -newkey rsa:2048 -keyout server1.key -out server1.csr
openssl x509 -CA dgraph-CA-cert.crt -CAkey dgraph-private.key -CAcreateserial -req -days 36500 -in server1.csr -out server1.crt
cat server1.key server1.crt > server1.pem //Maybe not needed
Then I start zero and server
dgraph zero --my=localhost:5080 -w zeroCluster --bindall &
dgraph server --my=localhost:7080 --lru_mb=1024 --zero=localhost:5080 -o 0 -p server0/p -w server0/w --bindall --tls_on --tls_ca_certs dgraph-CA-cert.crt --tls_cert server1.crt --tls_cert_key server1.key --tls_cert_key_passphrase somePass–tls_use_system_ca &
In my golang app I use:
package main
import (
"google.golang.org/grpc"
"log"
"context"
"github.com/dgraph-io/dgo/protos/api"
"github.com/dgraph-io/dgo"
"fmt"
"flag"
"google.golang.org/grpc/credentials"
"github.com/dgraph-io/dgraph/x"
)
var (
// TLS configuration
tlsEnabled = flag.Bool("tls.on", true, "Use TLS connections.")
tlsInsecure = flag.Bool("tls.insecure", false, "Skip certificate validation (insecure)")
tlsServerName = flag.String("tls.server_name", "", "Server name.")
tlsCert = flag.String("tls.cert", "server1.crt", "Certificate file path.")
tlsKey = flag.String("tls.cert_key", "server1.key", "Certificate key file path.")
tlsKeyPass = flag.String("tls.cert_key_passphrase", "somePass", "Certificate key passphrase.")
tlsRootCACerts = flag.String("tls.ca_certs", "dgraph-CA-cert.crt", "CA Certs file path.")
tlsSystemCACerts = flag.Bool("tls.use_system_ca", false, "Include System CA into CA Certs.")
tlsMinVersion = flag.String("tls.min_version", "TLS11", "TLS min version.")
tlsMaxVersion = flag.String("tls.max_version", "TLS12", "TLS max version.")
)
func setupConnection(host string) (*grpc.ClientConn, error) {
if !*tlsEnabled {
return grpc.Dial(host, grpc.WithInsecure())
}
tlsCfg, _, err := x.GenerateTLSConfig(x.TLSHelperConfig{
ConfigType: x.TLSClientConfig,
Insecure: *tlsInsecure,
ServerName: *tlsServerName,
Cert: *tlsCert,
Key: *tlsKey,
KeyPassphrase: *tlsKeyPass,
RootCACerts: *tlsRootCACerts,
UseSystemRootCACerts: *tlsSystemCACerts,
MinVersion: *tlsMinVersion,
MaxVersion: *tlsMaxVersion,
})
if err != nil {
return nil, err
}
return grpc.Dial(host, grpc.WithTransportCredentials(credentials.NewTLS(tlsCfg)))
}
func main() {
conn, err := setupConnection("37.0.0.164:9080")
//conn, err := grpc.Dial("37.0.0.164:9080", grpc.WithInsecure())
if err != nil {
log.Fatal("While trying to dial gRPC")
}
defer conn.Close()
dc := api.NewDgraphClient(conn)
dg := dgo.NewDgraphClient(dc)
ctx := context.Background()
q := `
schema{}
`
resp, err := dg.NewTxn().Query(ctx, q)
if err != nil {
log.Fatal(err)
}
fmt.Printf("Response: %s\n", resp.Json)
}
Can you explain and give examples for these parameters:
tlsServerName = flag.String(“tls.server_name”, “”, “Server name.”)
tlsSystemCACerts = flag.Bool(“tls.use_system_ca”, false, “Include System CA into CA Certs.”)
What’s my mistake?