Troubleshooting SSL Issues ​

This section identifies some common error conditions that may arise when you are setting up secure connections for Yellowbrick data warehouses.

"Server certificate...does not match hostname" ​

Most server certificates are based on host names. If you are using an SSL mode that requires trust, you need to know the correct host and domain name for the connection, not the IP address. Consider the following examples for a host named yb14.yellowbrick.io, using a wildcard cert where CN=*.slc.yellowbrick.io and verify-full SSL mode. The host name used in the connection must be a name in the domain and cannot be an IP address:

ybqsl "sslmode=verify-full sslrootcert=/mnt/c/ybd/my.pem host=10.10.114.10 dbname=yellowbrick user=yellowbrick"
ybsql: server certificate for "*.slc.yellowbrick.io" (and 1 other name) does not match host name "10.10.114.10"
..
ybsql "sslmode=verify-full sslrootcert=/mnt/c/ybd/my.pem host=yb14.yellowbrick.io dbname=yellowbrick user=yellowbrick"
ybsql: server certificate for "*.slc.yellowbrick.io" (and 1 other name) does not match host name "yb14.yellowbrick.io"

"root.crt does not exist" ​

If you are using an SSL mode that requires trust verification, you may see a message like this one:

ybsql: root certificate file "/home/user_1/.postgresql/root.crt" does not exist

To fix the problem, either provide the file or change the SSL mode to disable server certificate verification. Verify that your root.crt file is in the correct location and that you have adequate permissions on it. In particular, keep in mind that the location and names differ by operating system.

• Linux, AIX, macOS:

~/.postgresql/root.cert

~/.yellowbrick/root.cert

• Windows:

%APPDATA%\postgresql\root.crt

%APPDATA%\yellowbrick\root.crt

“SSL error: certificate verify failed” ​

This type of error occurs if you attempt to use an SSL mode that requires trust verification with an untrusted certificate, and you do not have the intermediary and/or root cert in your root cert file.

For example, a Yellowbrick data warehouse ships with a self-signed certificate so it is not trusted. Attempting a connection using an SSL mode of verify-ca results in an error:

ybsql "sslmode=verify-full sslrootcert=/~/my_root.pem host=yb.my.com dbname=dev user=me"
ybsql: SSL error: certificate verify failed