配置ssl后使用obproxy登录集群失败

[桃纭]

配置ssl后使用obproxy登录集群失败
集群

obproxy

好像改配置的地方已经配置了，证书已经加载了。现在是不能通过obproxy登录集群
[admin@odp wallet]$ obclient -h192.168.80.22 -P2883 -uroot@sys#hhobcluster -p’密码’ -Doceanbase -A
ERROR 2013 (HY000): Lost connection to MySQL server at ‘reading authorization packet’, system error: 11

[辞霜]

enable_server_ssl和 enable_client_ssl开启了么
https://www.oceanbase.com/docs/common-odp-doc-cn-1000000006242556
https://www.oceanbase.com/docs/common-odp-doc-cn-1000000006242578

[桃纭]

开了

[辞霜]

obproxy_diagnosis.log日志提供一份看下

[桃纭]

obproxy_diagnosis.log (19.9 KB)

[辞霜]

应该是ODP 与 OB 之间 SSL 握手失败
只有同时满足 enable_server_ssl=true 且证书配置有效，才会用 SSL 连 OB；否则走明文，OB 会直接拒绝
– 查看 SSL 是否开启
SHOW PARAMETERS LIKE ‘ssl_client_authentication’;
SHOW PARAMETERS LIKE ‘sql_protocol_min_tls_version’;
– 确认证书已加载
SELECT svr_ip, svr_port, ssl_cert_expired_time,
FROM_UNIXTIME(ssl_cert_expired_time/1000000) AS cert_expire
FROM oceanbase.GV$OB_SERVERS;

– 查看 SSL 开关
SHOW PROXYCONFIG LIKE ‘%ssl%’;