Is it necessary for a certificate to have an IP address?

Translated
1

Note:
This topic has been translated from a Chinese forum by GPT and might contain errors.

Original topic: 证书一定需要有ip地址吗？

| username: 月明星稀

ikv startup failed

pd log
[2023/07/12 19:11:00.347 +08:00] [DEBUG] [peer_status.go:82] [“peer deactivated again”] [peer-id=84c6fb284c03c211] [error=“failed to dial 84c6fb284c03c211 on stream MsgApp v2 (x509: cannot validate certificate for 1.1.1.3 because it doesn’t contain any IP SANs)”]
[2023/07/12 19:11:00.347 +08:00] [DEBUG] [peer_status.go:82] [“peer deactivated again”] [peer-id=542460a451f5b039] [error=“failed to dial 542460a451f5b039 on stream MsgApp v2 (x509: cannot validate certificate for 1.1.1.1 because it doesn’t contain any IP SANs)”]
[2023/07/12 19:18:36.760 +08:00] [WARN] [config_logging.go:287] [“rejected connection”] [remote-addr=1.1.1.1:35522] [server-name=] [error=“remote error: tls: bad certificate”]
[2023/07/12 19:18:36.760 +08:00] [WARN] [config_logging.go:287] [“rejected connection”] [remote-addr=1.1.1.1:35518] [server-name=] [error=“remote error: tls: bad certificate”]
[2023/07/12 19:18:36.780 +08:00] [WARN] [config_logging.go:287] [“rejected connection”] [remote-addr=1.1.1.3:36784] [server-name=] [error=“remote error: tls: bad certificate”]
[2023/07/12 19:18:36.781 +08:00] [WARN] [config_logging.go:287] [“rejected connection”] [remote-addr=1.1.1.3:36786] [server-name=] [error=“remote error: tls: bad certificate”]
[2023/07/12 19:18:36.798 +08:00] [DEBUG] [stream.go:597] [“dial stream reader”] [from=9355f7e22e1a34e2] [to=542460a451f5b039] [address=https://1.1.1.1:2380/raft/stream/msgapp/9355f7e22e1a34e2]
[2023/07/12 19:18:36.798 +08:00] [DEBUG] [stream.go:597] [“dial stream reader”] [from=9355f7e22e1a34e2] [to=84c6fb284c03c211] [address=https://1.1.1.3:2380/raft/stream/message/9355f7e22e1a34e2]
[2023/07/12 19:18:36.798 +08:00] [DEBUG] [stream.go:597] [“dial stream reader”] [from=9355f7e22e1a34e2] [to=84c6fb284c03c211] [address=https://1.1.1.3:2380/raft/stream/msgapp/9355f7e22e1a34e2]
[2023/07/12 19:18:36.798 +08:00] [DEBUG] [stream.go:597] [“dial stream reader”] [from=9355f7e22e1a34e2] [to=542460a451f5b039] [address=https://1.1.1.1:2380/raft/stream/message/9355f7e22e1a34e2]

tikv log:
[2023/07/12 19:17:10.799 +08:00] [INFO] [util.rs:598] [“connecting to PD endpoint”] [endpoints=1.1.1.1:2379]
[2023/07/12 19:17:12.800 +08:00] [INFO] [util.rs:560] [“PD failed to respond”] [err=“Grpc(RpcFailure(RpcStatus { code: 4-DEADLINE_EXCEEDED, message: "Deadline Exceeded", details: }))”] [endpoints=1.1.1.1:2379]
[2023/07/12 19:17:12.800 +08:00] [INFO] [util.rs:598] [“connecting to PD endpoint”] [endpoints=1.1.1.2:2379]
[2023/07/12 19:17:14.801 +08:00] [INFO] [util.rs:560] [“PD failed to respond”] [err=“Grpc(RpcFailure(RpcStatus { code: 4-DEADLINE_EXCEEDED, message: "Deadline Exceeded", details: }))”] [endpoints=1.1.1.2:2379]
[2023/07/12 19:17:14.801 +08:00] [INFO] [util.rs:598] [“connecting to PD endpoint”] [endpoints=1.1.1.3:2379]

Seeking advice from experts, please help answer, thank you.

  1. Does the certificate need to have a SAN IP address?
  2. Or is there another issue? How to solve it?
2
| username: Billmay表妹 | Original post link

PD response failure

3
| username: Billmay表妹 | Original post link

Provide the correct: IP SANs

4
| username: 月明星稀 | Original post link

Is it necessary for the SAN to include the local IP address?

5
| username: xfworld | Original post link

Is it not possible to do without a certificate?

When creating a certificate, you either specify a domain name or an IP address…

6
| username: zhanggame1 | Original post link

The certificate must have a domain name or IP, and it must be exactly the same as the hostname or IP in the URL being accessed.

7
| username: system | Original post link

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.