Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update log levels for Mutual TLS #369

Open
k0ekk0ek opened this issue Aug 2, 2024 · 1 comment
Open

Update log levels for Mutual TLS #369

k0ekk0ek opened this issue Aug 2, 2024 · 1 comment

Comments

@k0ekk0ek
Copy link
Contributor

k0ekk0ek commented Aug 2, 2024

Currently errors related to certificates for Mutual TLS are logged via DEBUG. Which means they are not available in release builds. Use a method, like normal log at level 5 or so to allow for more convenient debugging. See #362 for more details.

@bilias
Copy link
Contributor

bilias commented Aug 2, 2024

Notes:

Some common certificate errors I believe we should log in normal logging (5 or something else) with an clear message explaining the exact problem to the operator:

  • certificate CN/SAN mismatch with tls-auth auth-domain-name
  • certificate expired
  • tls-cert-bundle does not verify certificate given by client (server side)
  • tls-cert-bundle does not verify certificate given by server (client side)
  • possible connection errors on tls-auth-port
  • maybe better output when client requests tls XFR on non tls-auth-port
  • certificate/key open file errors or permissions problem/warning checks
  • other certificate errors?

Maybe some of them are already covered, I just wanted to document all possible (common) scenarios.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants