diff options
| author | Seunghun Lee <seunghun@stackhpc.com> | 2026-06-22 13:01:54 +0200 |
|---|---|---|
| committer | Seunghun Lee <seunghun@stackhpc.com> | 2026-07-22 14:15:30 +0100 |
| commit | 6c16ce6442af52a22357da69e41968f99c69d300 (patch) | |
| tree | 98fa7947b516c9f0223d3d0fad47da5fa848d4db /releasenotes/notes | |
| parent | 3082ed5b28229389bc47bb5ef03a935ec47e4c59 (diff) | |
| download | kolla-ansible-6c16ce6442af52a22357da69e41968f99c69d300.tar.gz kolla-ansible-6c16ce6442af52a22357da69e41968f99c69d300.zip | |
[stable-only] Split CA of ProxySQL internal TLS and backend TLS
ProxySQL frontend TLS (database internal TLS) and backend TLS (database
backend TLS) expects different CA if users use chain of certificates
(e.g. use of intermediate certificates).
Frontend TLS expects the intermediate certificate that signed the leaf
certificate as a CA file, whereas backend TLS expects root CA.
To fix, users are now required to create a file named
``proxysql-ca.pem`` at ``kolla_certificates_dir``, which is a copy of
the intermediate certificate.
If your system is not affected by this bug, you're not required to
create the new file ``proxysql-ca.pem``.
Closes-bug: #2150449
Change-Id: I88911badb0d0801f79317df6681c571cc1c8cfee
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
Diffstat (limited to 'releasenotes/notes')
| -rw-r--r-- | releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml b/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml new file mode 100644 index 000000000..fb3fb9db9 --- /dev/null +++ b/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml @@ -0,0 +1,14 @@ +--- +fixes: + - | + Fixes bug `LP#2150449 <https://bugs.launchpad.net/kolla-ansible/+bug/2150449>`__ + where ProxySQL's database internal TLS fails when users use chain of + certificates (e.g. use of intermediate certificates). + + Users who are affected by this bug needs to create a file + ``proxysql-ca.pem`` at ``certificates_internal_dir``. + This file needs to be a copy of the intermediate certificate (i.e. + certificate that signed database internal TLS) + + Users who are not affected by this bug does not need to do + anything. |