{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/3925","labels_url":"https://api.github.com/repos/coreos/etcd/issues/3925/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/3925/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/3925/events","html_url":"https://github.com/coreos/etcd/issues/3925","id":119075319,"number":3925,"title":"Question regarding clients and ssl","user":{"login":"cristifalcas","id":3647635,"avatar_url":"https://avatars.githubusercontent.com/u/3647635?v=3","gravatar_id":"","url":"https://api.github.com/users/cristifalcas","html_url":"https://github.com/cristifalcas","followers_url":"https://api.github.com/users/cristifalcas/followers","following_url":"https://api.github.com/users/cristifalcas/following{/other_user}","gists_url":"https://api.github.com/users/cristifalcas/gists{/gist_id}","starred_url":"https://api.github.com/users/cristifalcas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristifalcas/subscriptions","organizations_url":"https://api.github.com/users/cristifalcas/orgs","repos_url":"https://api.github.com/users/cristifalcas/repos","events_url":"https://api.github.com/users/cristifalcas/events{/privacy}","received_events_url":"https://api.github.com/users/cristifalcas/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-26T16:31:42Z","updated_at":"2015-12-21T23:57:26Z","closed_at":"2015-12-21T23:57:26Z","body":"Let me first explain the setup:\r\n\r\n* host1, host2, host3 are cluster members\r\n* hosts4,host5, etc are set as proxies to the above cluster\r\n* all etcd servers have for clients the listen urls and advertise urls set to 127.0.0.1 without ssl and for peers 0.0.0.0 with ssl\r\n\r\nCan a client installed on the same machine with a proxy connect to the cluster through localhost with no ssl?\r\n\r\nWhen I tried it failed, complaining that the certificate (there where no certificates involved for clients, obviously) was not good.\r\n\r\nI was expecting for this setup to work."},"comment":{"url":"https://api.github.com/repos/coreos/etcd/issues/comments/166462384","html_url":"https://github.com/coreos/etcd/issues/3925#issuecomment-166462384","issue_url":"https://api.github.com/repos/coreos/etcd/issues/3925","id":166462384,"user":{"login":"xiang90","id":4479947,"avatar_url":"https://avatars.githubusercontent.com/u/4479947?v=3","gravatar_id":"","url":"https://api.github.com/users/xiang90","html_url":"https://github.com/xiang90","followers_url":"https://api.github.com/users/xiang90/followers","following_url":"https://api.github.com/users/xiang90/following{/other_user}","gists_url":"https://api.github.com/users/xiang90/gists{/gist_id}","starred_url":"https://api.github.com/users/xiang90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiang90/subscriptions","organizations_url":"https://api.github.com/users/xiang90/orgs","repos_url":"https://api.github.com/users/xiang90/repos","events_url":"https://api.github.com/users/xiang90/events{/privacy}","received_events_url":"https://api.github.com/users/xiang90/received_events","type":"User","site_admin":false},"created_at":"2015-12-21T23:57:26Z","updated_at":"2015-12-21T23:57:26Z","body":"> all etcd servers have for clients the listen urls and advertise urls set to 127.0.0.1\r\n\r\nThis does not work. Proxy needs to use the advertised client url to contact etcd members. If you set it to localhost, proxy will try to talk with localhost(which is probably proxy itself in your case). So it fails to connect to the real etcd members.\r\n\r\nYou should set the advertised url correctly. Then everything should works.\r\n\r\nPlease check https://github.com/coreos/etcd/blob/master/Documentation/proxy.md for more information."}}