Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOCS: TLS for trino-cli needs some clarification on how to connect behind LoadBalancer which is doing mTLS termination #24037

Open
mrendi29 opened this issue Nov 5, 2024 · 0 comments

Comments

@mrendi29
Copy link

mrendi29 commented Nov 5, 2024

The docs for TLS need some clarification on how to connect to trino in cases where your load balancer is also doing mTLS termination. A conversation with @dain through the trino slack showed that the keystore is really sensitive to the ordering of the keys and we also discovered that the CAcerts must be individually imported if you have a long chain of CAs. In another example we noticed that you can also use a PEM cert of your client cert+key as the keystore, and the chain of CAs as the truststore.

The error that I often saw was:
$ ./trino --server https://example-trino-server.com/ --keystore-path=keystore.jks --keystore-password=admin --user=admin --password Password: trino> show tables; javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I will open a PR shortly that resolves this part in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant