[MDEV-23744] Unable to specify both client and server certificates. - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.4.14
Fix Version/s: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
Component/s: Galera, Galera SST, Server, wsrep
Labels:
- contribution
- docs_ok
Environment:
Ubuntu 20.04.

Bug Category:
Notable changes
Release Note Summary:

Hide
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server).

Eight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.

  Joiner (TLS server) role:
    ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.

  Donor (TLS client) role:
    ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.
    ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.
    ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.
    ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.

These are SST options read by the wsrep_sst_* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.

Show
State Snapshot Transfer (SST) can now use different TLS certificates, keys and CAs depending on the node's role in the transfer, for the mariabackup and rsync SST methods. This lets a single instance present a client certificate when it acts as the donor (TLS client) and a server certificate when it acts as the joiner (TLS server). Eight new options are added, read from the [sst] (or [mysqld]) option group. Each one overrides the corresponding generic ssl-* option for its role when set; when it is not set, the generic ssl-* option is used, so existing configurations behave exactly as before.   Joiner (TLS server) role:     ssl-server-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.     ssl-server-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.     ssl-server-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.     ssl-server-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used.   Donor (TLS client) role:     ssl-client-ca CA file used to verify the peer. Overrides ssl-ca when set; otherwise ssl-ca is used.     ssl-client-capath CA directory used to verify the peer. Overrides ssl-capath when set; otherwise ssl-capath is used.     ssl-client-cert Certificate the node presents. Overrides ssl-cert when set; otherwise ssl-cert is used.     ssl-client-key Private key for the certificate. Overrides ssl-key when set; otherwise ssl-key is used. These are SST options read by the wsrep_sst_* scripts, not server system variables. When none of the new options are set, SST behavior is identical to previous releases; the change is fully backward compatible.
Epic Link:
Galera SST Encryption Fixes
Sprint:
Q3/2026 Replic. Development

Description

With wsrep_sst_mariabackup, and sst encrypt 2 or 3 the role of donor or joiner controls if we are a listener or a connector.

However the parameters tca, tpem, and tkey are not role specific, despite the fact that in some environments the client and server certificates are different for the same instance.

This is further complicated by the possibility of those roles changing due to a failure and later recovery of the primary node in a cluster.

It looks like a change to wsrep_sst_mariabackup to optionally allow for separate joiner and donor tca, tcert, and tkey values would be reasonable trivial.

Would a patch to implement this be welcome? And if so, are there any preferred names for the options?

(If not, I will likely implement it as ssl_client_key, ssl_client_ca, and ssl_client_cert, as well as ssl_server_key, ssl_server_ca, and ssl_server_cert.)

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

wsrep_sst_mariabackup.diff
0.8 kB
2020-09-17 14:11

Activity

People

Assignee:: Hemant Dangi

Reporter:: Zephaniah Loss-Cutler-Hull

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2020-09-17 13:07

Updated:: 2026-08-10 20:18

Resolved:: 2026-07-20 18:40

Time Tracking

Estimated:

Remaining:

Logged:

1d 3h 50m

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.