I am getting this error "tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, not x.x.x.x"

[yogesh119905]

Hello All,
I am getting an error when I send the traces to jaeger node. the HotROD application is sending the traces but on hotrod docker container logs says below.
.
Is my jaeger configuration correct?

Below is jaeger configuration...root@virttracing1:~# cat /var/opt/jaeger/config/configuration.yml

Ansible managed: Do NOT edit this file manually!

---

service:
extensions:

• jaeger_storage
• jaeger_query
• healthcheckv2
  pipelines:
  traces:
  receivers:
  • otlp
    processors:
  • batch
    exporters:
  • jaeger_storage_exporter
    telemetry:
    resource:
    service.name: jaeger
    metrics:
    level: detailed
    address: 0.0.0.0:8888
    logs:
    level: info
    extensions:
    healthcheckv2:
    use_v2: true
    component_health:
    include_permanent_errors: false
    include_recoverable_errors: true
    recovery_duration: 5m
    http:
    endpoint: 0.0.0.0:13133
    tls:
    cert_file: /cmd/jaeger/tls/jaeger.crt
    key_file: /cmd/jaeger/tls/jaeger.key
    status:
    enabled: true
    path: /health/status
    jaeger_query:
    storage:
    traces: elastic_storage
    base_path: /
    ui:
    config_file: /cmd/jaeger/config/configuration-ui.json
    grpc:
    endpoint: 0.0.0.0:16685
    http:
    endpoint: 0.0.0.0:16686
    tls:
    cert_file: /cmd/jaeger/tls/jaeger.crt
    key_file: /cmd/jaeger/tls/jaeger.key
    jaeger_storage:
    backends:
    elastic_storage:
    elasticsearch:
    server_urls:
    • https://virtplatform.srv.gpe:9200
      tls:
      ca_file: /cmd/jaeger/tls/GPE-BTS-SST-Root-G1.crt
      auth:
      basic:
      username: fluentd
      password: fluentd_elastic
      indices:
      index_prefix: null
      spans:
      date_layout: '2006-01-02'
      rollover_frequency: day
      shards: 1
      replicas: 1
      services:
      date_layout: '2006-01-02'
      rollover_frequency: day
      shards: 1
      replicas: 1
      dependencies:
      date_layout: '2006-01-02'
      rollover_frequency: day
      shards: 1
      replicas: 1
      sampling:
      date_layout: '2006-01-02'
      rollover_frequency: day
      shards: 1
      replicas: 1
      receivers:
      otlp:
      protocols:
      grpc:
      endpoint: 0.0.0.0:4317
      http:
      endpoint: 0.0.0.0:4318
      tls:
      cert_file: /cmd/jaeger/tls/jaeger.crt
      key_file: /cmd/jaeger/tls/jaeger.key
      processors:
      batch: {}
      exporters:
      jaeger_storage_exporter:
      trace_storage: elastic_storage
      queue:
      num_consumers: 10
      queue_size: 100
      root@virttracing1:~#

[dosubot[bot]]

The error you're encountering, "tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, not x.x.x.x," typically occurs when the TLS certificate is issued for a specific domain or IP address (in this case, 127.0.0.1), but the request is being made to a different IP address (e.g., 192.168.121.37).

To resolve this issue, you can consider the following options:

1. Update the Certificate: Ensure that the TLS certificate includes the IP address or domain name you are using to access the Jaeger service. You may need to regenerate the certificate with the correct Subject Alternative Name (SAN) entries.

2. Use the Correct Hostname: If possible, configure your application to use the hostname or IP address that matches the certificate's SAN.

3. Skip Host Verification (Not Recommended for Production): As a temporary workaround, you can configure the HotROD application to skip host verification. This is generally not recommended for production environments due to security risks. If you choose this option, ensure it is only for testing purposes.

4. Check Jaeger Configuration: Verify that the Jaeger configuration is correctly set up to use the appropriate certificate files and that the endpoints are correctly configured to match the certificate's SAN.

If you need to handle IP address mismatches in TLS certificates, you can set the tls.skip-host-verify option to true in the Jaeger configuration. However, this should be used with caution as it bypasses the verification of the server's identity ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[yogesh119905]

@dosu, Can you please explain this "Update the Certificate: Ensure that the TLS certificate includes the IP address or domain name you are using to access the Jaeger service. You may need to regenerate the certificate with the correct Subject Alternative Name (SAN) entries." in detail?

[dosubot[bot]]

To update the TLS certificate to include the IP address or domain name for accessing the Jaeger service and regenerate the certificate with the correct Subject Alternative Name (SAN) entries, follow these steps:

1. Modify the gen_ssl_conf function to include the desired IP address or domain name in the SAN section. For example, if you want to add an IP address 192.168.1.1 and a domain mydomain.com, you would modify the function like this:

   gen_ssl_conf() {
     domain_name=$1
     output_file=$2
   
     cat << EOF > "$output_file"
   [ req ]
   prompt              = no
   default_bits        = 2048
   distinguished_name  = req_distinguished_name
   req_extensions      = req_ext
   
   [ req_distinguished_name ]
   countryName         = AU
   stateOrProvinceName = Australia
   localityName        = Sydney
   organizationName    = Logz.io
   commonName          = Jaeger
   
   [ req_ext ]
   subjectAltName      = @alt_names
   
   [alt_names]
   DNS.1               = $domain_name
   IP.1                = 192.168.1.1
   DNS.2               = mydomain.com
   EOF
   }

2. Generate the SSL configuration file with the updated SAN entries by calling gen_ssl_conf with the desired domain name:

   gen_ssl_conf mydomain.com "$tmp_dir/ssl.conf"

3. Run the script to generate the new certificates. Ensure that the script is executed with the necessary permissions and that OpenSSL is installed on your system. The script will create a temporary directory for the generated files and clean up after execution unless in dry-run mode.

4. Deploy the new certificates to your Jaeger service, replacing the old certificates with the newly generated ones.

By following these steps, you will regenerate the TLS certificate with the correct SAN entries, including the specified IP address and domain name. The script also includes a dry-run option (-d) that allows you to verify the process without modifying the PEM files ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}