Spring Cloud Vault error: nested exception is javax.net.ssl.SSLHandshakeException: extension (5) should not be presented in certificate_request

Question

I am trying to use HashiCorp Vault using Spring Cloud Vault on Spring Boot project. I configured my bootstrap.yml file to use app role and secret id to get passwords

bootstrap.yml

spring:
  application:
    name: pres
  cloud:
    vault:
      authentication: APPROLE
      app-role:
        role-id: ${role-id}
        secret-id: ${secret-id}
        role: pres-read
        app-role-path: approle
      uri: https://hostname:8200
      kv:
        enabled: true
        backend: secret
        application-name: pres
  profiles:
    include: dev

During startup I get the following exception

org.springframework.vault.authentication.VaultLoginException: Cannot login using org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://hostname:8200/v1/auth/approle/login": extension (5) should not be presented in certificate_request; nested exception is javax.net.ssl.SSLHandshakeException: extension (5) should not be presented in certificate_request

I am using spring-cloud-starter-vault-config dependency to access the vault

 <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-vault-config</artifactId>
            <version> 2.2.2.RELEASE</version>
 </dependency>

Which Vault version are you on? Found this similar sounding issue on github github.com/hashicorp/vault/issues/8750 - but not much activity going on in the issue — kgorskowski
Hi, I did some basic read up, the problem seems to be the tls negotiation between java and golang (vault) - there is more information on that github.com/golang/go/issues/35722 sorry but I am out of my waters in this topic. Better check the versions of your components for issues/bug reports regarding this matter — kgorskowski
@kgorskowski Thanks for the link. I followed workaround from here github.com/golang/go/issues/35722#issuecomment-571173416 and it works. — Pavan Jadda

Pavan Jadda Pavan Jadda · Accepted Answer · 2020-05-25T16:42:03

1

votes

Okay. It looks like this is a Java TLS Bug, hoping java team will fix this in Java 11.0.8.

Spring Cloud Vault error: nested exception is javax.net.ssl.SSLHandshakeException: extension (5) should not be presented in certificate_request

1 Answers