да, я по всякому пробовал
curl -vvv --key ./docker/clickhouse/ssl/client-key.pem --cert ./docker/clickhouse/ssl/client-cert.pem --cacert ./docker/clickhouse/ssl/ca-cert.pem
https://local.clickhouse.pro:8443/pingвот такое
curl: (60) SSL certificate problem: unable to get local issuer certificate
начинаю проверять, какого фига
openssl verify -CAfile ./docker/clickhouse/ssl/ca-cert.pem ./docker/clickhouse/ssl/client-cert.pem
CN = ClickHouse
error 20 at 0 depth lookup: unable to get local issuer certificate
error ./docker/clickhouse/ssl/client-cert.pem: verification failed
ДА КАК ТАК ТО?
вот же я это генерю с помощью CA
# ssl.conf
printf "[req] \n prompt=no \n utf8=yes \n distinguished_name=dn_details \n req_extensions=san_details \n [dn_details] \n commonName=ClickHouse \n [san_details] \n subjectAltName=
@alt_names \n [alt_names] \n DNS.1=
local.clickhouse.pro \n DNS.2=
www.local.clickhouse.pro" > ${CUR_DIR}/ssl/ssl.conf
# генерация CA
openssl genrsa -out "${CUR_DIR}/ssl/ca-key.pem" 2048
openssl req -new -key "${CUR_DIR}/ssl/ca-key.pem" -x509 -days 3650 -out "${CUR_DIR}/ssl/ca-cert.pem" -config ${CUR_DIR}/ssl/ssl.conf
# вот тут клиентский private ключ + CSR
openssl genrsa -out "${CUR_DIR}/ssl/client-key.pem" 2048
openssl req -new -nodes -key "${CUR_DIR}/ssl/client-key.pem" -out "${CUR_DIR}/ssl/client.csr" -config "${CUR_DIR}/ssl/ssl.conf"
# вот тут из CSR + ключ делаю CERT + добаляю CA
openssl x509 -req -sha256 -days 365 -in "${CUR_DIR}/ssl/client.csr" -signkey "${CUR_DIR}/ssl/client-key.pem" -out "${CUR_DIR}/ssl/client-cert.pem" -extensions san_details -CA "${CUR_DIR}/ssl/ca-cert.pem" -CAkey "${CUR_DIR}/ssl/ca-key.pem" -CAcreateserial -extfile "${CUR_DIR}/ssl/ssl.conf"
и оно никаких ошибок то не говорит, молча генерит файл
