0

I would like to establish a TLS encrypted connection to a PostgreSQL 11 database using Tokio as the framework, Deadpool as the connection pooler and rustls as TLS library.

I developed/modified the following code:

let pool = if let Some(ca_cert) = settings.db_ca_cert {
    let mut tls_config = ClientConfig::new();
    let cert_file = File::open(&ca_cert)?;
    let mut buf = BufReader::new(cert_file);
    tls_config.root_store.add_pem_file(&mut buf).map_err(|_| {
        anyhow::anyhow!("failed to read database root certificate: {}", ca_cert)
    })?;

    let tls = MakeRustlsConnect::new(tls_config);
    settings.pg.create_pool(tls)?
} else {
    settings.pg.create_pool(NoTls)?
};

My test scenario is taken from here:

  • PostgreSQL 11 docker container (including TLS turned on)
  • TLS was already tested successfully with the psql client

I now get the following error message and can't explain the problem. I already checked the access rights and other parameters.

/usr/local/bin/cargo run --color=always
    Finished dev [unoptimized + debuginfo] target(s) in 0.20s
     Running `target/debug/tokio-postgres-rustls-connection-pool-demo`
 DEBUG tokio_postgres_rustls_connection_pool_demo > settings: Settings { pg: Config { user: Some("postgres"), password: Some("postgres"), dbname: Some("postgres"), options: Some("sslrootcert=/xxx/tokio-postgres-rustls-connection-pool-demo/docker/files/cert/ca.pem"), application_name: None, ssl_mode: None, host: Some("127.0.0.1"), hosts: None, port: Some(6432), ports: None, connect_timeout: None, keepalives: None, keepalives_idle: None, target_session_attrs: None, channel_binding: None, manager: None, pool: None }, db_ca_cert: None }
Error: Backend(Error { kind: Connect, cause: Some(Os { code: 2, kind: NotFound, message: "No such file or directory" }) })

I looked at the logs of the database and could identify the following error:

[86] LOG:  XX000: could not accept SSL connection: Success
[86] LOCATION:  be_tls_open_server, be-secure-openssl.c:408

How can I solve the problem?

Shepmaster
  • 388,571
  • 95
  • 1,107
  • 1,366
ZPascal
  • 323
  • 2
  • 4
  • 14
  • Maybe the path to the certificate is wrong. – aventurin May 16 '21 at 09:38
  • I already checked that opportunity. The path and the access rights are correct. – ZPascal May 16 '21 at 09:49
  • Run `strace` on your program and look for errors. – Laurenz Albe May 16 '21 at 15:42
  • It's hard to answer your question because it doesn't include a [MRE]. We can't tell what crates (and their versions), types, traits, fields, etc. are present in the code. It would make it easier for us to help you if you try to reproduce your error on the [Rust Playground](https://play.rust-lang.org) if possible, otherwise in a brand new Cargo project, then [edit] your question to include the additional info. There are [Rust-specific MRE tips](//stackoverflow.com/tags/rust/info) you can use to reduce your original code for posting here. Thanks! – Shepmaster May 17 '21 at 17:40
  • [To make Stack Overflow a useful resource for future visitors beyond the context of your repository](https://meta.stackoverflow.com/q/380194/155423), please [edit] your question to add a [MRE] in the question itself, in addition to the link to your repository. – Shepmaster May 17 '21 at 17:40

0 Answers0