4

How do I configure Couchdb to use ssl, I've followed the instructions here with no success.

I generate my own self-signed certificate:

mkdir cert && cd cert
openssl genrsa > privkey.pem
openssl req -new -x509 -key privkey.pem -out mycert.pem -days 1095

I uncomment the relevent lines in /usr/local/etc/couchdb/local.ini

httpsd = {couch_httpd, start_link, [https]}

and point to my certificates

cert_file = /usr/local/etc/couchdb/certs/mycert.pem
key_file = /usr/local/etc/couchdb/certs/privkey.pem

But when I try test it

curl -k -v https://127.0.0.1:6984
* About to connect() to 127.0.0.1 port 6984 (#0)
*   Trying 127.0.0.1... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to 127.0.0.1:6984 
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984 

I'm really not sure what is wrong.

Notes

I've installed couchdb 1.2 from source as per the instructions here.

1
  • probably a typo, but you typed mkdir cert && cd cert and then you have /usr/local/etc/couchdb/cert__s__ in your local.ini.
    – tomferon
    Jan 30, 2013 at 16:38

2 Answers 2

2

So I executed the following commands:

# openssl genrsa -out localhost.key 2048

# openssl req -new -x509 -key localhost.key -out localhost.crt -days 3650 -subj /CN=localhost

After that, I configure the the local.ini as follow: (making sure that those certificate files are acessible from couchdb user):

[daemons]
httpsd = {couch_httpd, start_link, [https]}

[ssl]
cert_file = /opt/couchdb/etc/cert/localhost.crt
key_file = /opt/couchdb/etc/cert/localhost.key

When I run this command at my pc, this works fine:

curl -v -k https://localhost:6984/
0

I was going crazy with basically the same issue, but on RHEL6 with CouchDB 1.6.1.

Browsing through endless mailing lists, realization dawned on me that it was likely an "unidentified" problem with the erlang SSL libraries causing this silent fail.

My workaround (which does work for me) was to use stunnel.

  • Download/install
  • Create your certs as before

Here's a draft setup for stunnel assuming you have a key/crt pair self-signed with open SSL:

fips = no

[couchdb]
accept = 6984
key = [path to your key file]
cert = [path to your cert file]
connect = 127.0.0.1:5984

Note that stunnel was whining about something related to FIPS on my local, so I ended up disabling it for quick gratification, hence the fips = no line.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .