{"action":"created","issue":{"url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/27","labels_url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/27/comments","events_url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/27/events","html_url":"https://github.com/tagomoris/fluent-plugin-secure-forward/issues/27","id":98444291,"number":27,"title":"Public CA Cert appears as invalid","user":{"login":"clu-0x80","id":12462571,"avatar_url":"https://avatars.githubusercontent.com/u/12462571?v=3","gravatar_id":"","url":"https://api.github.com/users/clu-0x80","html_url":"https://github.com/clu-0x80","followers_url":"https://api.github.com/users/clu-0x80/followers","following_url":"https://api.github.com/users/clu-0x80/following{/other_user}","gists_url":"https://api.github.com/users/clu-0x80/gists{/gist_id}","starred_url":"https://api.github.com/users/clu-0x80/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clu-0x80/subscriptions","organizations_url":"https://api.github.com/users/clu-0x80/orgs","repos_url":"https://api.github.com/users/clu-0x80/repos","events_url":"https://api.github.com/users/clu-0x80/events{/privacy}","received_events_url":"https://api.github.com/users/clu-0x80/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-07-31T18:15:55Z","updated_at":"2015-12-02T05:48:33Z","closed_at":"2015-11-24T11:21:34Z","body":"I have attempted to setup a receiver with a public CA cert and it is being deemed as untrusted by both the sender and external utilities such as openssl.\r\n\r\nThe reciever has a public CA issued cert from godaddy which has a 3 part bundle of intermediate CA certs that is appended into a pem file (key, cert, bundle). The cert is a wildard cert that is in production elsewhere so it is trusted elsewhere. So I feel the problem is that part of the certificate chain is not being sent.\r\n\r\nCan an option be made to specify intermediate CAs?\r\n\r\n**Recv Source Config:**\r\n\r\n<source>\r\n        type secure_forward\r\n        shared_key      TjKjGwwNyLD3McwD4\r\n        self_hostname   logging.company.co\r\n        secure  true\r\n        cert_path       /etc/td-agent/ssl/wildcard_company_co-godaddy-2015.pem\r\n        private_key_path /etc/td-agent/ssl/wildcard_company_co-godaddy-2015.key\r\n        private_key_passphrase \r\n        authentication  yes\r\n\r\n        <user>\r\n                username        compuser\r\n                password        compass\r\n        </user>\r\n</source>\r\n\r\n**Sender Source Config:**\r\n<match **>\r\n  type secure_forward\r\n  shared_key TjKjGwwNyLD3McwD4\r\n  self_hostname  appserver.company.co\r\n  secure true\r\n  enable_strict_verification    yes\r\n\r\n  <server>\r\n    host logging.company.co  # or IP\r\n    # port 24284\r\n    username    compuser\r\n    password    compass\r\n  </server>\r\n</match>\r\n\r\n**Sender td-agent logs:**\r\n015-07-31 10:57:30 +0100 [warn]: failed to establish SSL connection error_class=OpenSSL::SSL::SSLError error=#<OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed> host=\"logging.company.co\" address=\"123.123.123.123\" port=24284\r\n\r\n\r\n**OpenSSL output from domain using this cert and considered trusted:**\r\nCertificate chain\r\n 0 s:/OU=Domain Control Validated/CN=*.company.co\r\n   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2\r\n 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2\r\n   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2\r\n 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2\r\n   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority\r\n 3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority\r\n   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority\r\n\r\n**TD-Agent Receiver connection output:**\r\nopenssl s_client -connect logging.company.co:24284 \r\nCONNECTED(00000003)\r\ndepth=0 OU = Domain Control Validated, CN = *.company.co\r\nverify error:num=20:unable to get local issuer certificate\r\nverify return:1\r\ndepth=0 OU = Domain Control Validated, CN = *.company.co\r\nverify error:num=27:certificate not trusted\r\nverify return:1\r\ndepth=0 OU = Domain Control Validated, CN = *.company.co\r\nverify error:num=21:unable to verify the first certificate\r\nverify return:1\r\nCertificate chain\r\n 0 s:/OU=Domain Control Validated/CN=*.company.co\r\n   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/comments/161187848","html_url":"https://github.com/tagomoris/fluent-plugin-secure-forward/issues/27#issuecomment-161187848","issue_url":"https://api.github.com/repos/tagomoris/fluent-plugin-secure-forward/issues/27","id":161187848,"user":{"login":"tagomoris","id":230654,"avatar_url":"https://avatars.githubusercontent.com/u/230654?v=3","gravatar_id":"","url":"https://api.github.com/users/tagomoris","html_url":"https://github.com/tagomoris","followers_url":"https://api.github.com/users/tagomoris/followers","following_url":"https://api.github.com/users/tagomoris/following{/other_user}","gists_url":"https://api.github.com/users/tagomoris/gists{/gist_id}","starred_url":"https://api.github.com/users/tagomoris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tagomoris/subscriptions","organizations_url":"https://api.github.com/users/tagomoris/orgs","repos_url":"https://api.github.com/users/tagomoris/repos","events_url":"https://api.github.com/users/tagomoris/events{/privacy}","received_events_url":"https://api.github.com/users/tagomoris/received_events","type":"User","site_admin":false},"created_at":"2015-12-02T05:48:33Z","updated_at":"2015-12-02T05:48:33Z","body":"Hmm, weird. I tried this plugin v 0.3.3 with RHEL 6.7 (can't get 6.4 OS image) and td-agent 2.2.1. It works fine.\r\n\r\n```\r\n[tagomoris@td-agent-test ~]$ sudo td-agent-gem install fluent-plugin-secure-forward\r\nWARN: Unresolved specs during Gem::Specification.reset:\r\n      json (>= 1.4.3)\r\nWARN: Clearing out unresolved specs.\r\nPlease report a bug if this causes problems.\r\nFetching: resolve-hostname-0.0.4.gem (100%)\r\nSuccessfully installed resolve-hostname-0.0.4\r\nFetching: proxifier-1.0.3.gem (100%)\r\nSuccessfully installed proxifier-1.0.3\r\nFetching: fluent-plugin-secure-forward-0.3.3.gem (100%)\r\nSuccessfully installed fluent-plugin-secure-forward-0.3.3\r\nParsing documentation for fluent-plugin-secure-forward-0.3.3\r\nInstalling ri documentation for fluent-plugin-secure-forward-0.3.3\r\nParsing documentation for proxifier-1.0.3\r\nInstalling ri documentation for proxifier-1.0.3\r\nParsing documentation for resolve-hostname-0.0.4\r\nInstalling ri documentation for resolve-hostname-0.0.4\r\nDone installing documentation for fluent-plugin-secure-forward, proxifier, resolve-hostname after 0 seconds\r\n3 gems installed\r\n[tagomoris@td-agent-test ~]$ sudo vi /etc/td-agent/td-agent.conf \r\n[tagomoris@td-agent-test ~]$ sudo service td-agent restart\r\nShutting down td-agent:                                    [  OK  ]\r\nStarting td-agent:                                         [  OK  ]\r\n```\r\n\r\nLogs:\r\n```\r\n2015-12-02 05:45:19 +0000 [info]: reading config file path=\"/etc/td-agent/td-agent.conf\"\r\n2015-12-02 05:45:19 +0000 [info]: starting fluentd-0.12.12\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-mixin-config-placeholders' version '0.3.0'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-mixin-plaintextformatter' version '0.2.6'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-mongo' version '0.7.10'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-rewrite-tag-filter' version '1.4.1'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-s3' version '0.5.9'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-scribe' version '0.10.14'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-secure-forward' version '0.3.3'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-td' version '0.10.27'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-td-monitoring' version '0.2.1'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluent-plugin-webhdfs' version '0.4.1'\r\n2015-12-02 05:45:19 +0000 [info]: gem 'fluentd' version '0.12.12'\r\n2015-12-02 05:45:19 +0000 [info]: adding match pattern=\"td.*.*\" type=\"tdlog\"\r\n2015-12-02 05:45:19 +0000 [info]: adding match pattern=\"debug.**\" type=\"stdout\"\r\n2015-12-02 05:45:19 +0000 [info]: adding source type=\"forward\"\r\n2015-12-02 05:45:19 +0000 [info]: adding source type=\"http\"\r\n2015-12-02 05:45:19 +0000 [info]: adding source type=\"debug_agent\"\r\n2015-12-02 05:45:19 +0000 [info]: adding source type=\"secure_forward\"\r\n2015-12-02 05:45:19 +0000 [warn]: 'insecure' mode has vulnerability for man-in-the-middle attacks for clients (output plugins).\r\n2015-12-02 05:45:19 +0000 [info]: using configuration file: <ROOT>\r\n  <match td.*.*>\r\n    type tdlog\r\n    apikey xxxxxx\r\n    auto_create_table \r\n    buffer_type file\r\n    buffer_path /var/log/td-agent/buffer/td\r\n    <secondary>\r\n      type file\r\n      path /var/log/td-agent/failed_records\r\n      buffer_path /var/log/td-agent/failed_records.*\r\n    </secondary>\r\n  </match>\r\n  <match debug.**>\r\n    type stdout\r\n  </match>\r\n  <source>\r\n    type forward\r\n  </source>\r\n  <source>\r\n    type http\r\n    port 8888\r\n  </source>\r\n  <source>\r\n    type debug_agent\r\n    bind 127.0.0.1\r\n    port 24230\r\n  </source>\r\n  <source>\r\n    @type secure_forward\r\n    port 24224\r\n    self_hostname hoge.pos.com\r\n    secure no\r\n    shared_key xxxxxx\r\n  </source>\r\n</ROOT>\r\n2015-12-02 05:45:19 +0000 [info]: listening fluent socket on 0.0.0.0:24224\r\n2015-12-02 05:45:19 +0000 [info]: listening dRuby uri=\"druby://127.0.0.1:24230\" object=\"Engine\"\r\n```"}}