Vault tls_require_and_verify_client_cert

[tsiamer]

Hi,

When enabling Vault tls_require_and_verify_client_cert to true in vault, i just cant seem to connect to vault using:

{{ lookup('community.hashi_vault.hashi_vault',  'secret=cred/data/test:test url={{ vault_url }}   token={{vault_token}} validate_certs=True   cacert=/etc/ansible/ca.pem' )}}

Cannot seem to find how to pass the client pub and pvt key, tried multiple parameters ie: cert_auth_public_key: & cert_auth_private_key: on pem format butnothing worked, the error i get:

(Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)'))). HTTPSConnectionPool(host='', port=8200): Max retries exceeded with url: /v1/secret=cred/data/test (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)')))"}

When require from vault is turn off tls it starts working.

[briantist]

Hi @tsiamer , the error is coming directly from the underlying SSL components and they are giving a bad cert error. Is it possibly because Vault is behind a terminating load balancer? See: https://groups.google.com/g/vault-tool/c/x7LX4rglOQI/m/2lfz5YBnBgAJ

Are you able to reproduce the problem by running a Vault dev server locally on your machine?

---

Not related to your question, but you should consider migrating away from the community.hashi_vault.hashi_vault lookup to our other plugins/modules, or at least stop using term string parameters, see also:

• https://docs.ansible.com/ansible/devel/collections/community/hashi_vault/docsite/about_hashi_vault_lookup.html
• https://docs.ansible.com/ansible/devel/collections/community/hashi_vault/docsite/migration_hashi_vault_lookup.html

[tsiamer]

Hi Briantist, Thanks for the reply, vault is not behind a proxy basically i set it up to require clients to provide clients certs to be able to connect to vault, this is not cert auth , tls_require_and_verify_client_cert = "true" , i really cannot disable it , in other applications i just add client_cert and client_key but cannot find any parameters in hashi.

https://developer.hashicorp.com/vault/docs/configuration/listener/tcp

This is the error:

fatal: [remote.local]: FAILED! => {"msg": "An unhandled exception occurred while templating '{{ lookup('community.hashi_vault.hashi_vault', 'secret=xxxxxxxxxxxxxxxurl={{ vault_url }} token={{vault_token}} validate_certs=True cacert=/etc/ansible/-ca.pem' )}}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'community.hashi_vault.hashi_vault'. Error was a <class 'requests.exceptions.SSLError'>, original message: HTTPSConnectionPool(host='vault.local', port=8200): Max retries exceeded with url: /v1/cred/data/test (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)'))). HTTPSConnectionPool(host='vault.test', port=8200): Max retries exceeded with url: /v1/cred/data/test (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)')))"}

If i set in vault ls_require_and_verify_client_cert = "false" i just present this alidate_certs=True cacert=/etc/ansible/ca.pem' and works without any issue.

The certs are valid, because they are use to access the UI, curl, powershell invoke and so on.

[briantist]

Thank you @tsiamer I appreciate the additional information.

This collection is mostly a wrapper around the hvac library. Are you by any chance able to use client certs successfully in Python using hvac?

• https://github.com/hvac/hvac
• https://hvac.readthedocs.io/

If so, having working sample code with hvac would help a lot of in figuring out where we are going wrong in the collection.

If it not working in hvac either, then we can raise an issue there and try to fix it upstream first (I am also a maintainer on that project).

[tsiamer]

Hi Brian,

import hvac

cacert = "/etc/consul-template.d/home-consul-agent-ca.pem"
cert=("/etc/consul-template.d/mdc-cli-home-consul-0.pem", "/etc/consul-template.d/mdc-cli-home-consul-0-key.pem")
client = hvac.Client(url="https://active.vault.service.home-consul:8200", token="xxxxxxxxxxxxxxx", verify=cacert)

assert client.is_authenticated()

Error below, similar:

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/requests/adapters.py", line 486, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen
    retries = retries.increment(
  File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='active.vault.service.home-consul', port=8200): Max retries exceeded with url: /v1/auth/token/lookup-self (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.8/dist-packages/hvac/v1/__init__.py", line 410, in is_authenticated
    self.lookup_token()
  File "/usr/local/lib/python3.8/dist-packages/hvac/v1/__init__.py", line 331, in lookup_token
    return self._adapter.get(path, wrap_ttl=wrap_ttl)
  File "/usr/local/lib/python3.8/dist-packages/hvac/adapters.py", line 110, in get
    return self.request("get", url, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/hvac/adapters.py", line 372, in request
    response = super().request(*args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/hvac/adapters.py", line 331, in request
    response = self.session.request(
  File "/usr/local/lib/python3.8/dist-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.8/dist-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/requests/adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='active.vault.service.home-consul', port=8200): Max retries exceeded with url: /v1/auth/token/lookup-self (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2635)')))

[briantist]

@tsiamer thanks, in your error output I see a retry error, but the example code does not use retries. The top of the error output also references an "above exception" but it does not seem to be included.

In the sample code, the cert variable is set but I do not see where it is used.

[tsiamer]

@briantist no problem, that is the only output i got, similar one when using hashi lookup.