I have a problem with self-signed certificates in an
etcd cluster. The certificates are ok because if I use them in
nginx, there is no error at all as long as I add the CA file to my certs store.
This is a capture of a
curl --cacert ca.pem https://192.168.73.120:2379 when using
However, if instead of using
nginx I use
etcd (which is the real service I want to setup), a
curl --cacert ca.pem https://192.168.73.120:2379/v2/keys for example, throws
curl: (35) Unknown SSL protocol error in connection to 192.168.73.120:-9825 in Mac OS or
curl: (35) gnutls_handshake() failed: Certificate is bad in Linux.
The following is a network capture when using
etcd https://www.cloudshark.org/captures/124df64051af. As you can see in packet 21, server is returning a
Some researching about
curl error code 35 indicates that the reason might be:
- Ciphers: not a problem, both using
- Permissions: not a problem either, cert files are set to 644 and key files to 600.
- Procotol: not a problem, both use
- Expired private key: it was just generated with 365 days of lifetime, so not expired.
If I use
Chrome, I get
ERR_BAD_SSL_CLIENT_AUTH_CERT. However, inspecting the console, it says the certificate is valid (because I added the CA to my store).
So really I'm out of ideas right now. What do you think might be the root of this issue?