Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I configure Couchdb to use ssl, I've followed the instructions here with no success.

I generate my own self-signed certificate:

mkdir cert && cd cert
openssl genrsa > privkey.pem
openssl req -new -x509 -key privkey.pem -out mycert.pem -days 1095

I uncomment the relevent lines in /usr/local/etc/couchdb/local.ini

httpsd = {couch_httpd, start_link, [https]}

and point to my certificates

cert_file = /usr/local/etc/couchdb/certs/mycert.pem
key_file = /usr/local/etc/couchdb/certs/privkey.pem

But when I try test it

curl -k -v https://127.0.0.1:6984
* About to connect() to 127.0.0.1 port 6984 (#0)
*   Trying 127.0.0.1... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to 127.0.0.1:6984 
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984 

I'm really not sure what is wrong.

Notes

I've installed couchdb 1.2 from source as per the instructions here.

share|improve this question
    
probably a typo, but you typed mkdir cert && cd cert and then you have /usr/local/etc/couchdb/cert__s__ in your local.ini. –  thoferon Jan 30 '13 at 16:38
add comment

1 Answer

So I executed the following commands:

# openssl genrsa -out localhost.key 2048

# openssl req -new -x509 -key localhost.key -out localhost.crt -days 3650 -subj /CN=localhost

After that, I configure the the local.ini as follow: (making sure that those certificate files are acessible from couchdb user):

[daemons]
httpsd = {couch_httpd, start_link, [https]}

[ssl]
cert_file = /opt/couchdb/etc/cert/localhost.crt
key_file = /opt/couchdb/etc/cert/localhost.key

When I run this command at my pc, this works fine:

curl -v -k https://localhost:6984/
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.