What goes in TrustedRootCertificatesPath?

EventStoreDB V20
#1

For SSL on my webserver I use a .pfx file with a password. I also have the corresponding .crt and .key files. I think these go in CertificateFile, CertificatePrivateKeyFile, and CertificatePassword. Is that right? And if that’s the case what does TrustedRootCertificatesPath want?

I followed this example https://www.albertocorrales.com/2020/11/setup-eventstoredb-on-aws-ec2-with.html and got things running, but of course the SSL was insecure and curl wouldn’t work.

For SSL on my webserver I only needed to generate set of cryptographic files { pfx, crt, key } , but looks like eventstore needs two sets.

#2

this should help you setting that up
https://developers.eventstore.com/server/v20/server/installation/#configuration-wizard

#3

Hi Yves, thanks for your help, but I’m still missing something:

Are CertificateFile and CertificatePrivateKeyFile different for each node, or is it expecting my wildcard .crt and .key files I use to enable SSL on my webserver?

I tried putting { wwd.ai.pem, shop.wwd.ai.pem, *.wwd.ai.pem } into /etc/ssl/certs with the relevant CertificatePassword – eventstore runs but it didn’t like the SSL configuration and gives me browser warning : “this site is not safe”

Paths

Db: /var/lib/eventstore
Index: /var/lib/eventstore/index
Log: /var/log/eventstore

Certificates configuration

CertificateFile: /etc/eventstore/certs/node.crt #generated with es-gencert-cli (should it be my wildcard certificate?)
CertificatePrivateKeyFile: /etc/eventstore/certs/node.key #generated with es-gencert-cli (should it be my wildcard certificate?)
TrustedRootCertificatesPath: /etc/ssl/certs
CertificateReservedNodeCommonName: “*.wwd.ai” #surprised quotes are needed here.
CertificatePassword: “mypfxpassword” #quotes? or no quotes? # how does it know what this password applies to ?? This is the password for my wildcard certificate

Network configuration

IntIp: 193.8.194.36
ExtIp: 193.8.194.36
IntHostAdvertiseAs: shop.wwd.ai
ExtHostAdvertiseAs: shop.wwd.ai
HttpPort: 2113
IntTcpPort: 1112
ExtTcpPort: 1113
EnableExternalTcp: true
EnableAtomPubOverHTTP: true

Projections configuration

RunProjections: All

#4

@patrickinminneapolis Indeed, you can configure a certificate per node. However, as I see, the certs are configured, as you can access the browser page. Is your certificate generated by some public trusted authority? If not, then you need to add them to a trusted local store on the client machine not to see the warning.
See more in https://developers.eventstore.com/server/v20/server/security/configuration.html#certificate-installation-on-a-client-environment

#5

I generated node.crt and node.key with es-gencert-cli, then copied node.crt to /usr/local/share/ca-certificates/ and ran sudo update-ca-certificates. This still results in browser warning.

Then I tried the crt and key i use for my webserver that was generated by a public authority CertificateFile and CertificatePrivateKeyFile, but then eventstore just died silently (nothing in the logs even)

#attempt 1: works but browser warning
CertificateFile: /etc/eventstore/certs/node.crt
CertificatePrivateKeyFile: /etc/eventstore/certs/node.key
TrustedRootCertificatesPath: /usr/local/share/ca-certificates

#attempt2 : just silently fails
CertificateFile: /etc/eventstore/real/wwd.ai.crt
CertificatePrivateKeyFile: /etc/eventstore/certs/real/wwd.ai.key
CertificateReservedNodeCommonName: “*.wwd.ai”
CertificatePassword: “mypassword”

Let me know anything jumps out at you, as I don’t even know what question to ask at this point

#6

Self-signed certificates always give browser warnings because, well, they are self-signed. You need to add the CA certificate to your local trusted CA store and you won’t see the warning again.