Connecting with SSL using CAStore

[Shayon]

OTP_VERSION = 22.0.5

We've been having an issue using the newest version of Redix at 0.10.4, after upgrading from 0.10.2, regarding connecting to our Elasticache Redis. We have added {:castore, "~> 0.1.5"} as a dep in our mix.exs. As per documentation We invoke start_link/2 like so:

Redix.start_link(some_uri, name: some_name, socket_opts: [customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)]])

We have checked that Redix.URI.opts_from_uri(some_uri) returns a keyword list containing ssl: true.

When attempting to invoke commands using this Redix connection we see the error:

** (Redix.ConnectionError) the connection to Redis is closed
    (redix) lib/redix.ex:629: Redix.command!/3
    (our_app) lib/our_app/redis.ex:37: OurApp.Redis.do_something/0

Is there something that we are doing incorrectly? Or is there a bug here somewhere?

[whatyouhide]

Hey @Shayon, I don't have time to investigate right now, but can you try the master branch of Redix? I'm thinking maybe bc90891 fixed this. Also, can you show the code that you were using on 0.10.2 to connect to Redis?

[jnatherley]

Encountered the same issue through Nebulex Redis Adapter and connected remotely using the Redix examples and error 😱

I'll do some testing of different versions

[jnatherley]

I get OTP 22.5 elixir 1.10:

[warn] Failed to connect to redis-domain:6379: non-existing domain

edit:

Passing socket options actually resolved the issues and using master:

socket_opts:[ [customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)]]]

[Shayon]

Unfortunately, using master did not work. I started it like so:

Redix.start_link(redix_config[:url], name: redix_config[:name], socket_opts: [customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)]])

And while that command successfully returned a pid, running any command shows the same error in my original post.

The code I use in 0.10.2 to start redix looks like:

supervisor_children = [{Redix, {redix_config[:url], name: redix_config[:name]}} | other_children]

[whatyouhide]

I'll have time to look at this next week probably. @voltone, anything that jumps out to you here? Thanks in advance!

[voltone]

Are there any ssl errors in the logs?

For AWS servers it is typically necessary to increase the verification depth from the default of 1. Can you try adding depth: 3 to the socket_opts?

[jnatherley]

https://elixirforum.com/t/yet-another-elixir-and-erlang-docker-image/28740 <- Probably related to this

Our main issue is that image tags are not immutable. If you pull the image elixir:1.9.4 you do not know which Erlang version or OS version you are getting. This is specially a problem when the tag the image points to changes to update the Erlang version. Recently Erlang introduced a breaking change in a minor version that made it an error when you started a client side SSL connection with the honor_cipher_order option, the Elixir image was updated to the new Erlang version which caused hackney to break and our deploys stopped working without any changes to either our dependencies or our Dockerfile.

[whatyouhide]

Ping @Shayon?

[Shayon]

Thanks @voltone! Looks like depth: 3 did it! Tried that with both master and 0.10.4 and both worked 🎉

In this case the docs that talk about Elasticache specifically might want to mention depth: 3 as well 🤷‍♂️

@jnatherley We already ran into the SSL issue with the Erlang minor bump and so we lowered our Erlang version to compensate. However, the exact problem stated in the forum post has bitten us a bunch of times already - super happy that the folks at Hex are trying to combat the issue. So many thanks for bringing their solution to my attention 😄

Thanks for the help all. @whatyouhide feel free to close the issue, or leave it open until the additional documentation is added

[DianaOlympos]

So we got hit by that today, we needed a depth of 3 but without bc90891 you get the default depth of 2, due to change in 22.0.5

With master it works. Would it be possible to get a release to Hex with this change @whatyouhide ?

Btw thanks to @voltone for helping us find this one.

[voltone]

And maybe change the default depth to 3 in that new version as well. When I originally proposed 2 I thought that would be enough for most use-cases, but it seems ElastiCache requires 3.

[jredville]

Following up to see if we can get a release to Hex with these changes? That would be helpful for @Shayon and myself moving forward

[whatyouhide]

Thank you all. I updated the default depth to 3 and released v0.10.5. :)