Problem Statement

The following rpk cluster info command failed with the error "unable to request metadata: unable to dial: tls: failed to verify certificate: x509: certificate signed by unknown authority".
Here is an example;

$ rpk cluster info -X tls.enabled=true
unable to request metadata: unable to dial: tls: failed to verify certificate: x509: certificate signed by unknown authority

In the Redpanda log, we could see the following messages when the rpk command failed.

WARN 2025-01-03 05:30:47,719 [shard 0:main] kafka - server.cc:402 - Error kafka rpc protocol 10.244.1.11:41074: std::__1::system_error (error OpenSSL:167773202, Failed to establish SSL handshake: [error:0A000412:SSL routines::sslv3 alert bad certificate]: error:0A000412:SSL routines::sslv3 alert bad certificate) (sasl state: initial)
ERROR 2025-01-03 05:30:47,719 [shard 0:main] kafka - server.cc:159 - Error[applying protocol] remote address: 10.244.1.11:41074 - std::__1::system_error (error OpenSSL:167773202, Failed to establish SSL handshake: [error:0A000412:SSL routines::sslv3 alert bad certificate]: error:0A000412:SSL routines::sslv3 alert bad certificate)

How can I make the rpk command work? 

Solution

The error message indicates that the client failed to verify the server's TSL certificate. In the case of the rpk command, there are two options:
1. Ignore the certificate authority
    Please use -X tls.insecure_skip_verify=true option 

2. Get the certificate of the certificate authority and use it as a trusted ca
    Please use -X tls.ca= option

 

Here is an example of using the "-X tls.insecure_skip_verify=true" option

$ rpk cluster info -X tls.enabled=true -X tls.insecure_skip_verify=true
CLUSTER
=======
redpanda.55a22754-83b4-421f-b3c5-a466a54e4333

BROKERS
=======
ID HOST PORT
0 redpanda-0.redpanda.redpanda-system.svc.cluster.local. 9093
1 redpanda-1.redpanda.redpanda-system.svc.cluster.local. 9093
2* redpanda-2.redpanda.redpanda-system.svc.cluster.local. 9093

TOPICS
======
NAME       PARTITIONS REPLICAS
_schemas            1        3
test001             1        3

Here is an example of using the -X tls.ca= option.

$ rpk cluster info -X tls.enabled=true -X tls.ca=/etc/tls/certs/default/ca.crt
CLUSTER
=======
redpanda.55a22754-83b4-421f-b3c5-a466a54e4333

BROKERS
=======
ID HOST PORT
0 redpanda-0.redpanda.redpanda-system.svc.cluster.local. 9093
1 redpanda-1.redpanda.redpanda-system.svc.cluster.local. 9093
2* redpanda-2.redpanda.redpanda-system.svc.cluster.local. 9093

TOPICS
======
NAME PARTITIONS REPLICAS
_schemas.     1        3
test001       1        3

 

Notes

If you have any questions on this notice or need further guidance, please contact customer-success@redpanda.com / support@redpanda.com