Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I configure Couchdb to use ssl, I've followed the instructions here with no success.

I generate my own self-signed certificate:

mkdir cert && cd cert
openssl genrsa > privkey.pem
openssl req -new -x509 -key privkey.pem -out mycert.pem -days 1095

I uncomment the relevent lines in /usr/local/etc/couchdb/local.ini

httpsd = {couch_httpd, start_link, [https]}

and point to my certificates

cert_file = /usr/local/etc/couchdb/certs/mycert.pem
key_file = /usr/local/etc/couchdb/certs/privkey.pem

But when I try test it

curl -k -v https://127.0.0.1:6984
* About to connect() to 127.0.0.1 port 6984 (#0)
*   Trying 127.0.0.1... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to 127.0.0.1:6984 
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984 

I'm really not sure what is wrong.

Notes

I've installed couchdb 1.2 from source as per the instructions here.

share|improve this question
    
probably a typo, but you typed mkdir cert && cd cert and then you have /usr/local/etc/couchdb/cert__s__ in your local.ini. – thoferon Jan 30 '13 at 16:38

So I executed the following commands:

# openssl genrsa -out localhost.key 2048

# openssl req -new -x509 -key localhost.key -out localhost.crt -days 3650 -subj /CN=localhost

After that, I configure the the local.ini as follow: (making sure that those certificate files are acessible from couchdb user):

[daemons]
httpsd = {couch_httpd, start_link, [https]}

[ssl]
cert_file = /opt/couchdb/etc/cert/localhost.crt
key_file = /opt/couchdb/etc/cert/localhost.key

When I run this command at my pc, this works fine:

curl -v -k https://localhost:6984/
share|improve this answer

I was going crazy with basically the same issue, but on RHEL6 with CouchDB 1.6.1.

Browsing through endless mailing lists, realization dawned on me that it was likely an "unidentified" problem with the erlang SSL libraries causing this silent fail.

My workaround (which does work for me) was to use stunnel.

  • Download/install
  • Create your certs as before

Here's a draft setup for stunnel assuming you have a key/crt pair self-signed with open SSL:

fips = no

[couchdb]
accept = 6984
key = [path to your key file]
cert = [path to your cert file]
connect = 127.0.0.1:5984

Note that stunnel was whining about something related to FIPS on my local, so I ended up disabling it for quick gratification, hence the fips = no line.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.