[MDEV-26834] Node not able to join cluster WSREP_SST: [ERROR] The certificate and private key do not match Created: 2021-10-14  Updated: 2021-12-09

Status: Open
Project: MariaDB Server
Component/s: Galera SST
Affects Version/s: 10.3.31
Fix Version/s: 10.3

Type: Bug Priority: Major
Reporter: Yakov Kushnirsky Assignee: Ramesh Sivaraman
Resolution: Unresolved Votes: 0
Labels: None
Environment:

10.3.31
OpenSSL



 Description   

Node not able to join cluster WSREP_SST: [ERROR] The certificate and private key do not match

Openssl and certification key match.

openssl rsa -noout -modulus -in server-key.pem md5sum....
openssl x509 -noout -modulus -in server-key.pem md5sum....

WSREP_SST: [INFO] Using socat as streamer (20211014 15:07:00.112)
WSREP_SST: [INFO] Using openssl based encryption with socat: with key and crt (20211014 15:07:00.122)
WSREP_SST: [ERROR] ***************** FATAL ERROR ******************* (20211014 15:07:00.131)
WSREP_SST: [ERROR] * The certificate and private key do not match. * (20211014 15:07:00.134)
WSREP_SST: [ERROR] * Please check your certificate and key files. * (20211014 15:07:00.138)
WSREP_SST: [ERROR] ***************** FATAL ERROR ******************* (20211014 15:07:00.140)

Downgrade to 10.3.29 resolved the issue



 Comments   
Comment by Yakov Kushnirsky [ 2021-10-15 ]

10.4.21 also reportedly work without issue.

Comment by Gregory Orange [ 2021-12-09 ]

Using Mariadb 10.3.31 on Ubuntu 20.04, this error struck us when it was automatically upgraded last week to 10.3.32. The Puppet module http://github.com/puppetlabs/puppetlabs-mysql sets these values by default:

ssl = false
ssl-ca = /etc/mysql/cacert.pem
ssl-cert = /etc/mysql/server-cert.pem
ssl-key = /etc/mysql/server-key.pem

Those files do not exist. Commenting out all but 'ssl = false' and re-bootstrapping the cluster has fixed the problem. This was working fine until the new version, so we surmise the logic interplay between the different variables has changed.

Generated at Thu Feb 08 09:48:18 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.