emqx 5.0.26 双向认证问题

环境

  • EMQX 版本:
  • 操作系统版本:

重现此问题的步骤

  1. xxx
  2. xxx
  3. xxx

预期行为

实际行为

在使用Aws负载均衡后 出现
2023-11-20T08:15:03.494277+00:00 error: {“time”:1700468103494277,“pid”:“<0.1199.1319>”,“msg”:“supervisor: ‘esockd_connection_sup - <0.1199.1319>’, errorContext: connection_shutdown, reason: {ssl_error,{tls_alert,{certificate_required,"TLS server: In state wait_cert at tls_handshake_1_3.erl:1479 generated SERVER ALERT: Fatal - Certificate required\n certificate_required"}}}, offender: [{pid,<0.1294.1319>},{name,connection},{mfargs,{emqx_connection,start_link,[#{enable_authn => true,limiter => undefined,listener => {ssl,default},zone => default}]}}]”,“level”:“error”,“error_logger”:{“type”:“supervisor_report”,“tag”:“error_report”},“domain”:[“supervisor_report”]}
2023-11-20T08:15:03.504460+00:00 notice: {“time”:1700468103504460,“pid”:“<0.813.1319>”,“msg”:“TLS server: In state wait_cert at tls_handshake_1_3.erl:1479 generated SERVER ALERT: Fatal - Certificate required, - certificate_required”,“line”:1479,“level”:“notice”,“depth”:20,“mfa”:“tls_handshake_1_3:process_certificate/2”}
2023-11-20T08:15:03.504990+00:00 error: {“time”:1700468103504990,“pid”:“<0.1199.1319>”,“msg”:“supervisor: ‘esockd_connection_sup - <0.1199.1319>’, errorContext: connection_shutdown, reason: {ssl_error,{tls_alert,{certificate_required,"TLS server: In state wait_cert at tls_handshake_1_3.erl:1479 generated SERVER ALERT: Fatal - Certificate required\n certificate_required"}}}, offender: [{pid,<0.1336.1319>},{name,connection},{mfargs,{emqx_connection,start_link,[#{enable_authn => true,limiter => undefined,listener => {ssl,default},zone => default}]}}]”,“level”:“error”,“error_logger”:{“type”:“supervisor_report”,“tag”:“error_report”},“domain”:[“supervisor_report”]}
错误,如果不经过负载均衡则没问题。请问是哪里的错误

Certificate required\n certificate_required

从报错的信息来看,可能服务端配置了需要客户端提供证书(即双向认证)但是客户端连接过程没有提供。

所以应该是 AWS 和 TLS 配置和 EMQX 直接暴露的 TLS 不太一样的。

方便吧整个 TLS 监听器的配置贴到这里看看么?


这是配置的服务端证书

这里配置看起来是需要客户端做双向的 TLS 连接的。客户端那边是这样做的么?从之前的报错来看,它应该是没传自己证书