Absolute paths for TLS cert and key does not work #3700
Description
Tendermint version (use tendermint version or git rev-parse --verify HEAD if installed from source):
0.31.5
ABCI app (name for built-in, URL for self-written if it's publicly available):
self-written
Environment:
- OS (e.g. from /etc/os-release): darwin
- Install tools:
- Others:
What happened:
tendermint rpc server tls doesn't work
What you expected to happen:
It shall work
Have you tried the latest version: yes
How to reproduce it (as minimally and precisely as possible):
- create a self-signed certificate and key
- put them in config folder and add them into config.toml
tls_cert_file = "cert.pem"
tls_key_file = "key"
- start tendermint, and try to connect to it
➜ curl -v -k https://127.0.0.1:32767/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 32767 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
It should give me Server Hello response, but it gives me nothing and stuck there.
To make sure the self-signed cert and key are good, here's a working example with a local http server with same cert and key:
➜ curl -v -k https://127.0.0.1:9999
* Rebuilt URL to: https://127.0.0.1:9999/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9999 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
...
Logs (paste a small part showing an error (< 10 lines) or link a pastebin, gist, etc. containing more of the log file):
Config (you can paste only the changes you've made):
node command runtime flags:
/dump_consensus_state output for consensus bugs
Anything else we need to know:
The tls support was added here: #3469
However it feels like doesn't work, and I cannot find any test related to it.