{"action":"created","issue":{"url":"https://api.github.com/repos/codership/galera/issues/457","repository_url":"https://api.github.com/repos/codership/galera","labels_url":"https://api.github.com/repos/codership/galera/issues/457/labels{/name}","comments_url":"https://api.github.com/repos/codership/galera/issues/457/comments","events_url":"https://api.github.com/repos/codership/galera/issues/457/events","html_url":"https://github.com/codership/galera/issues/457","id":215464521,"number":457,"title":"Initial bootstrap fails with TLS/SSL configured","user":{"login":"ac-astuartkregor","id":13316387,"avatar_url":"https://avatars2.githubusercontent.com/u/13316387?v=3","gravatar_id":"","url":"https://api.github.com/users/ac-astuartkregor","html_url":"https://github.com/ac-astuartkregor","followers_url":"https://api.github.com/users/ac-astuartkregor/followers","following_url":"https://api.github.com/users/ac-astuartkregor/following{/other_user}","gists_url":"https://api.github.com/users/ac-astuartkregor/gists{/gist_id}","starred_url":"https://api.github.com/users/ac-astuartkregor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ac-astuartkregor/subscriptions","organizations_url":"https://api.github.com/users/ac-astuartkregor/orgs","repos_url":"https://api.github.com/users/ac-astuartkregor/repos","events_url":"https://api.github.com/users/ac-astuartkregor/events{/privacy}","received_events_url":"https://api.github.com/users/ac-astuartkregor/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-03-20T15:49:55Z","updated_at":"2017-04-03T08:19:27Z","closed_at":null,"body":"Apologies if this repo is the wrong place for this issue, or if I'm doing something daft.\r\n\r\n## Problem encountered\r\n**Tl;dr** - TLS prevents a cluster from being created for the first time.\r\n\r\nOn a fresh install of MariaDB on CentOS 7.3, if TLS/SSL is configured, the first node of the cluster will successfully start using `galera_new_cluster`, but other nodes cannot join the cluster and fail to start.\r\n\r\nHowever, if the cluster is configured __without__ TLS, other nodes can join the cluster successfully.\r\n\r\nOnce this initial bootstrap of a cluster is complete, TLS can be configured and the cluster can be successfully bootstrapped once again.\r\n\r\n## Steps to reproduce\r\nOn a number of servers:\r\n1. Install a CentOS 7.3 minimal image and setup networking to the internet and between the servers in the cluster\r\n2. Install the percona-release-0.1-4 RPM for their repos\r\n3. Install MariaDB repos\r\n4. Install the following packages:\r\n    * MariaDB-server-10.1.22-1\r\n    * galera-25.3.19-1\r\n    * percona-toolkit-3.0.1-1\r\n    * percona-xtrabackup-24-2.4.6-2\r\n    * socat-1.7.2.2-5\r\n5. Generate necessary certificates and configure MariaDB, wsrep and SST to use TLS\r\n6. Secure the installation in the normal manner\r\n7. Start one node with `galera_new_cluster`\r\n8. Attempt to start the mysql service on a second node\r\n\r\n## Notes\r\n* If TLS is not set up, then the installation works just fine and nodes can join the cluster.\r\n* If a node has been in the cluster before and TLS is configured afterwards, this will also work.\r\n* If a node has never been in a cluster and has TLS configured, it will not be able to join the cluster.\r\n\r\nThe galera and MariaDB packages installed are coming from the MariaDB CentOS yum repository."},"comment":{"url":"https://api.github.com/repos/codership/galera/issues/comments/291077580","html_url":"https://github.com/codership/galera/issues/457#issuecomment-291077580","issue_url":"https://api.github.com/repos/codership/galera/issues/457","id":291077580,"user":{"login":"ac-astuartkregor","id":13316387,"avatar_url":"https://avatars2.githubusercontent.com/u/13316387?v=3","gravatar_id":"","url":"https://api.github.com/users/ac-astuartkregor","html_url":"https://github.com/ac-astuartkregor","followers_url":"https://api.github.com/users/ac-astuartkregor/followers","following_url":"https://api.github.com/users/ac-astuartkregor/following{/other_user}","gists_url":"https://api.github.com/users/ac-astuartkregor/gists{/gist_id}","starred_url":"https://api.github.com/users/ac-astuartkregor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ac-astuartkregor/subscriptions","organizations_url":"https://api.github.com/users/ac-astuartkregor/orgs","repos_url":"https://api.github.com/users/ac-astuartkregor/repos","events_url":"https://api.github.com/users/ac-astuartkregor/events{/privacy}","received_events_url":"https://api.github.com/users/ac-astuartkregor/received_events","type":"User","site_admin":false},"created_at":"2017-04-03T08:19:27Z","updated_at":"2017-04-03T08:19:27Z","body":"I will try and get logs for you however I feel the issue is related to Galera since I am trying to set up a multi-node cluster. It could be something to do with the SST provider (xtrabackup-2) or something else but it'd be interesting to hear opinions.\r\n\r\nTLS/SSL configured means adding the `ssl-ca`, `ssl-key` and `ssl-cert` variables for mysqld and client/mysql sections using correct and verified certificates. Also setting `wsrep_provider_options` to include `socket.ssl_key`, `socket.ssl_cert`, `socket.ssl_ca` variables.\r\n\r\nFrom what I recall, the problems seem to occur when setting the options in `wsrep_provider_options`."}}
{"actor":{"display_login":"ac-astuartkregor"}}