blackbox_exporter icon indicating copy to clipboard operation
blackbox_exporter copied to clipboard

insecure_skip_verify is not honored when cert/key pair exist

Open igaskin opened this issue 3 years ago • 0 comments

Upgrading from v0.14.0 to v0.19.0 caused a breakage in one module that is configured with a cert/key pair but also has insecure_skip_verify: true. It appears that insecure_skip_verify is no longer honored if cert_file and key_file are present.

Host operating system: output of uname -a

/ # uname -a
Linux blackbox-68c49985cd-w56cb 4.15.0-142-generic #146-Ubuntu SMP Tue Apr 13 01:11:19 UTC 2021 x86_64 GNU/Linux

blackbox_exporter version: output of blackbox_exporter --version

v0.19.0

What is the blackbox.yml module config.

  http:
      preferred_ip_protocol: ip4
      tls_config:
        insecure_skip_verify: true
        cert_file: cert.crt
        key_file: key.key

What logging output did you get from adding &debug=true to the probe URL?

mycompany.acme/healthz level=info msg="Making HTTP request" url=mycompany.acme/healthz host=mycompany.acme 
ts=2021-06-24T22:45:46.955282475Z caller=main.go:130 module=http_2xx_client_ca_skip_verify target=https://mycompany.acme/healthz level=error msg="Error for HTTP request" err="Get \"mycompany.acme/healthz\": remote error: tls: unknown certificate authority"
ts=2021-06-24T22:45:46.955376119Z caller=main.go:130 module=http_2xx_client_ca_skip_verify target=https://mycompany.acme/healthz level=info msg="Response timings for roundtrip" roundtrip=0 start=2021-06-24T22:45:46.937867465Z dnsDone=2021-06-24T22:45:46.937867465Z connectDone=2021-06-24T22:45:46.938556024Z gotConn=0001-01-01T00:00:00Z responseStart=0001-01-01T00:00:00Z tlsStart=2021-06-24T22:45:46.938588646Z tlsDone=2021-06-24T22:45:46.955234467Z end=0001-01-01T00:00:00Z 
ts=2021-06-24T22:45:46.955415921Z caller=main.go:320 module=http_2xx_client_ca_skip_verify target=https://mycompany.acme/healthz level=error msg="Probe failed" duration_seconds=0.021524712  

What did you do that produced an error?

upgrading the blackbox-exporter

What did you expect to see?

skipping tls

What did you see instead?

cert validation failures

igaskin avatar Jun 25 '21 01:06 igaskin