Problem Statement

Redpanda logs showed a "GnuTLS error." How can we troubleshoot?

Here is an example of the error.

ERROR 2025-01-16 20:30:09,317 [shard 0:main] kafka - server.cc:159 - Error[applying protocol] remote address: 172.92.28.195:25228 - std::__1::system_error (error GnuTLS:-12, A TLS fatal alert has been received.)

Solution

First, Redpanda moved from the GnuTLS to the OpenSSL library in v24.2.

Therefore, if you see a GnuTLS error in the Redpanda log, the Redpanda version must be very old and maybe the End of Life. We strongly recommend upgrading the Redpanda to the supported version. 
Please visit the Redpanda Supported Version page to check which version is supported. 

Otherwise, this error indicated that the client couldn't validate the Redpanda server's certificate. Potentially, the Redpanda server certificate was expired, or the DNS/server name of the certificate didn't match the broker host name. The Redpanda cluster may not function properly in such a case due to the certificate error.

It could be the client issue if the Redpanda cluster works okay while you see the error only from certain client IP addresses. For example, this error may happen if the client does not have the certificate issuer to validate the Redpanda certificate. 

 

In case, the client was rpk command and the TLS certificate was signed by a self-generated CA, the command may return the following error.

$ rpk cluster info -b -X brokers=redpanda-0.kumopanda.com:31092 -X user=admin -X pass=changeme123 -X sasl.mechanism=SCRAM-SHA-512 -X tls.enabled=true unable to request metadata: unable to dial: tls: failed to verify certificate: x509: "redpanda-cluster.redpanda.redpanda-system.svc.cluster.local" certificate is not standards compliant

In this case, you can use "-X tls.insecure_skip_verify=true" option to skip the variation or "-X --cacert "

Here is a successful example using "-X tls.insecure_skip_verify=true"

$ rpk cluster info -b -X brokers=redpanda-0.redpanda-support.com:31092 -X user=admin -X pass=changeme123 -X sasl.mechanism=SCRAM-SHA-512 -X tls.insecure_skip_verify=true
ID HOST PORT
0* redpanda-0.redpanda-support.com 31092
1 redpanda-1.redpanda-support.com 31092
2 redpanda-2.redpanda-support.com 31092

Notes

If you have any questions on this notice or need further guidance, please contact customer-success@redpanda.com / support@redpanda.com