Environment
Debian 10
Problem/Question
Hi,
I’m trying to setup encrypted streaming between two netdata instances, one acting as a parent, and the other as a child.
Everything works as expected when streaming without SSL. But when I enable SSL in the child destination configuration, the child suddenly can’t connect to the parent. It keeps trying to connect unsuccessfully.
Here is a sample of the child’s error.log :
2021-01-13 15:22:42: netdata INFO : STREAM_SENDER[child] : STREAM slave [send to parent:19996]: connecting...
2021-01-13 15:22:42: netdata INFO : STREAM_SENDER[child] : STREAM slave [send to parent:19996]: initializing communication...
2021-01-13 15:22:42: netdata ERROR : STREAM_SENDER[child] : SSL cannot connect with the server: error:00000000:lib(0):func(0):reason(0)
And here is a sample of the parent’s access.log :
2021-01-13 14:30:20: 521: 9620 '[CHILD_IP]:50842' 'CONNECTED'
2021-01-13 14:30:20: 521: 9620 '[CHILD_IP]:50842' 'DISCONNECTED'
2021-01-13 14:30:25: 522: 9620 '[CHILD_IP]:50880' 'CONNECTED'
2021-01-13 14:30:25: 522: 9620 '[CHILD_IP]:50880' 'DISCONNECTED'
2021-01-13 14:30:30: 523: 9620 '[CHILD_IP]:50922' 'CONNECTED'
2021-01-13 14:30:30: 523: 9620 '[CHILD_IP]:50922' 'DISCONNECTED'
My configuration
Port 19999 is used behind an Nginx proxy with basic auth for the dashboard.
Port 19996 is open and directly used for streaming.
I use a letsencrypt certificate for SSL communications but this should not matter as I disabled certificate verification for testing.
Parent’s netdata.conf
[web]
ssl key = /etc/letsencrypt/live/certificate/privkey.pem
ssl certificate = /etc/letsencrypt/live/certificate/cert.pem
bind to = *:19999=dashboard|netdata.conf^SSL=optional, *:19996=streaming^SSL=optional
Parent’s stream.conf
[111...555]
enabled = yes
allow from = *
default history = 3600
default memory mode = ram
health enabled = yes
default postpone alarms on connect seconds = 60
Child’s stream.conf
[stream]
enabled = yes
destination = parent:19996:SSL
ssl skip certificate verification = yes
api key = 111...555
timeout seconds = 60
default port = 19999
send charts matching = *
buffer size bytes = 1048576
reconnect delay seconds = 5
initial clock resync iterations = 60