Connecting to Cassandra using SSL

voltone · March 24, 2020, 8:14am

The :versions option should not really affect the certificate chain verification.

I believe the ‘unknown CA’ error happens because Amazon’s root CA is a cross-signed CA certificate, and the chain the server is sending includes the cross-signed intermediate version that was signed by another root CA. Such configurations are not very well supported by the :ssl application.

You can fix this by creating a CA store that includes both the Amazon root CA (from your current AmazonRootCA1.pem file) and the ‘/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority’ certificate (see below). Then update the :cacertfile option to point to that new file with both certs. That should work both with Amazon’s current configuration and in the future once they remove the cross-signing CAs and rely only on their own root CA.

During testing keep in mind that :ssl enables session reuse by default, meaning connections to a specific server will skip the TLS handshake if a prior connection to that server can be resumed. In that case, and new ssl options you passed will simply be ignored. If you restart your application every time this is not an issue, but it can bite you when trying things in iEX.