Jira (PDB-944) PuppetDB should respond 'unauthenticated' when not provided a client cert

[John Duarte (JIRA)]

Title: Message Title

John Duarte created an issue   PuppetDB / PDB-944 PuppetDB should respond 'unauthenticated' when not provided a client cert Issue Type: Improvement Assignee: Unassigned Components: UX Created: 06/Oct/14 1:02 PM Priority: Normal Reporter: John Duarte Making an SSL API call to PuppetDB without providing the client certificate fails with an `Unknown SSL protocol error`. Although the failure is expected, it does not provide the user with any information as to what the problem is. The documentation informs the user that a client certificate needs to be provided when making SSL calls to the PuppetDB API: curl 'https://<your.puppetdb.server>:8081/v3/facts/<node>' --cacert /etc/puppet/ssl/certs/ca.pem --cert /etc/puppet/ssl/certs/<node>.pem --key /etc/puppet/ssl/private_keys/<node>.pem However, if the user has not consulted the docs and attempts to connect to PuppetDB without the client cert, there little indication about what has gone wrong. SSL simply closes the connection and nothing is put into the logs. Example: Connecting to localhost without SSL on localhost succeeds as expected root@adgu6el75l86g8s:~# curl -v 'http://localhost:8080/v3/version' * About to connect() to localhost port 8080 (#0) * Trying ::1... * Connection refused * Trying 127.0.0.1... * connected * Connected to localhost (127.0.0.1) port 8080 (#0) > GET /v3/version HTTP/1.1 > User-Agent: curl/7.26.0 > Host: localhost:8080 > Accept: */* > * additional stuff not fine transfer.c:1037: 0 0 * HTTP 1.1 or later with persistent connection, pipelining supported < HTTP/1.1 200 OK < Date: Mon, 06 Oct 2014 19:56:42 GMT < Content-Type: application/json; charset=utf-8 < Content-Length: 27 < Server: Jetty(9.1.z-SNAPSHOT) < { "version" : "2.2.0.1" * Connection #0 to host localhost left intact }* Closing connection #0 Connecting to localhost via SSL fails (as expected, but with no indication as to why). root@adgu6el75l86g8s:~# curl -v -k 'https://localhost:8081/v3/version' * About to connect() to localhost port 8081 (#0) * Trying ::1... * connected * Connected to localhost (::1) port 8081 (#0) * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * SSLv3, TLS handshake, Client hello (1): * SSLv3, TLS handshake, Server hello (2): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Request CERT (13): * SSLv3, TLS handshake, Server finished (14): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Client key exchange (16): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * Unknown SSL protocol error in connection to localhost:8081 * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to localhost:8081 An enhancement as suggested by Nick Lewis: It's using client-auth: need, and it should probably be client-auth: want and return a useful error ("unauthenticated") if you don't use a cert Add Comment   This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.