Unable to connect Corda node to Postgres with SSL

Question

My Postgres DB in GCP (Google Cloud Platform) only accepts connections over SSL.
I tried the below inside my node.conf without any success:

dataSourceProperties {
    dataSourceClassName = "org.postgresql.ds.PGSimpleDataSource"
    dataSource.url = "jdbc:postgresql://db-private-ip:5432/my_node"
    dataSource.ssl = true
    dataSource.sslMode = verify-ca
    dataSource.sslRootCert = "/opt/corda/db-certs/server-ca.pem"
    dataSource.sslCert = "/opt/corda/db-certs/client-cert.pem"
    dataSource.sslKey = "/opt/corda/db-certs/client-key.pem"
    dataSource.user = my_node_db_user
    dataSource.password = my_pass
}

I'm sure that the keys (sslMode, sslRootCert, sslCert, and sslKey) are acceptable in node.conf (even though they are not mentioned anywhere in Corda docs), because in the logs I didn't get any errors that those key are not recognized.
I get this error when I try to start the node:

[ERROR] 21:58:48+0000 [main] pool.HikariPool. - HikariPool-1 - Exception during pool initialization. [errorCode=zmhrwq, moreInformationAt=https://errors.corda.net/OS/4.3/zmhrwq]
[ERROR] 21:58:48+0000 [main] internal.NodeStartupLogging. - Could not connect to the database. Please check your JDBC connection URL, or the connectivity to the database.: Could not connect to the database. Please check your JDBC connection URL, or the connectivity to the database. [errorCode=18t70u2, moreInformationAt=https://errors.corda.net/OS/4.3/18t70u2]

I tried adding ?ssl=true to the end of the data source URL as suggested in (Azure Postgres Database requires SSL Connection from Corda) but that didn't fix the problem.

Also for the same values I'm able to use the psql client to connect my VM to the DB:

psql "sslmode=verify-ca sslrootcert=server-ca.pem sslcert=client-cert.pem sslkey=client-key.pem hostaddr=db-private-ip user=some-user dbname=some-pass"

Is it OpenSource or Enterprise?

Wawrzek
– Wawrzek

2019-12-03 09:08:10 +00:00
Commented Dec 3, 2019 at 9:08 — Wawrzek
– Wawrzek, Commented Dec 3, 2019 at 9:08
It's OpenSource.

Adel Rustum
– Adel Rustum

2019-12-03 13:34:17 +00:00
Commented Dec 3, 2019 at 13:34 — Adel Rustum
– Adel Rustum, Commented Dec 3, 2019 at 13:34

Adel Rustum · Accepted Answer · 2019-12-03 18:07:30Z

1

Turns out the JDBC driver cannot read the key from a PEM file, it has to be converted to a DER file using:

openssl pkcs8 -topk8 -inform PEM -in client-key.pem -outform DER -nocrypt -out client-key.der

chmod 400 client-key.der
chown corda:corda client-key.der

More details here: https://github.com/pgjdbc/pgjdbc/issues/1364

So the correct config should look like this:

dataSourceProperties {
    dataSourceClassName = "org.postgresql.ds.PGSimpleDataSource"
    dataSource.url = "jdbc:postgresql://db-private-ip:5432/db-name"
    dataSource.ssl = true
    dataSource.sslMode = verify-ca
    dataSource.sslRootCert = "/opt/corda/db-certs/server-ca.pem"
    dataSource.sslCert = "/opt/corda/db-certs/client-cert.pem"
    dataSource.sslKey = "/opt/corda/db-certs/client-key.der"
    dataSource.user = db-user-name
    dataSource.password = db-user-pass
}

answered Dec 3, 2019 at 18:07

Adel Rustum

2,5482 gold badges9 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Adel Rustum Over a year ago

Full details are here: blog.b9lab.com/…

Collectives™ on Stack Overflow

Unable to connect Corda node to Postgres with SSL

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related