Issue while starting Tyk-Dashboard

Support Installation and Deployment
1

Hi Team,

I have configured tyk-dashboard to enable SSL and run on https://, please see the below configuration,
Have private certificate, concatenated, certificate and key into one pem file and used in the below configuration,

tyk_analytics.conf
“listen_port”: 443,
“notifications_listen_port”: 5000,
“tyk_api_config”: {
“Host”: “https://localhost”,
“Port”: “8080”,
“Secret”: “352d20ee67be67f6340b4c0605b044b7”
},
“http_server_options”: {
“use_ssl”: true,
“server_name”: “publicurl.com”,
“certificates”: [
{
“domain_name”: “*.publicurl.com”,
“cert_file”: “./certificateFile.pem”,
“key_file”: “./certificateFile.pem”
}
]
},

Now while starting Tyk-dashboard , I am getting below errors,

→ level=error msg=“Couldn’t unmarshal configuration”
→ level=error msg=“json: cannot unmarshal string into Go struct field DomainConfig.portal_domains of type map[string]string”
→ level=panic msg=“Server creation failed! listen tcp :443: bind: permission denied”
→ panic: (*logrus.Entry) (0xc398e0,0xc420354a00)

Please assist me with the corrective measures

Regards

2

Hi, can you share the full dashboard configuration file? It looks like an issue with the host_config configuration block.

The second error might be an issue with the TCP port, is the dashboard already running?

Best.

3

Hi @matiasb

If I am running dashboard with https configuration then it is not getting started and getting stopped with the errors mentioned above.

Please find the complete tyk_analytics.conf file

tyk_analytics_1
tyk_analytics_1.PNG624×900 15.6 KB

tyk_analytics_2

4

Hi,

Now port issue is no more, but instead certificate issue is appearing when doing dashboard and gateway start

Both dashboard and gateway are on same machine
OS : Debian 9
Installation : On prem

Dashboard log:
http: TLS handshake error from XX.XX.XX.XXX:41052: remote error: tls: bad certificate
http: TLS handshake error from XX.XX.XX.XXX:41052: remote error: tls: bad certificate

Gateway Log:
level=error msg=“Request failed with error Get https://XX.XX.XX.XXX:3000/register/node: x509: cannot validate certificate for XX.XX.XX.XXX because it doesn’t contain any IP SANs; retrying in 5s”
level=error msg=“Request failed with error Get https://XX.XX.XX.XXX:3000/register/node: x509: cannot validate certificate for XX.XX.XX.XXX because it doesn’t contain any IP SANs; retrying in 5s”
level=error msg=“Request failed with error Get https://XX.XX.XX.XXX:3000/register/node: x509: cannot validate certificate for XX.XX.XX.XXX because it doesn’t contain any IP SANs; retrying in 5s”

Regards

5

If your certificates you are using are self signed you will need to add ssl_insecure_skip_verify: true to the http_server_options to both of your configs.

6

Hi Josh,

No, I am using signed certificate

7

Is your certificate for the IP and not the domain for your localhost?

8

Hi @Josh

Certificate is for the public domain name.

Setup is like below:

  1. Tyk is install on the machine with machine name : machin.domain.com
  2. For the same machine public domain is created.

Certificate is for the public domain name

Regards

9

I think the connection between the dashboard and gateway being on the same machine means that they are trying to connect to each other on the localhost IP which is not listed in the cert and so it is considered invalid. Can you add the domain the cert is registered to your hosts file on the machine.

10

that is already done, as machine is manage centrally.

DNSName have been added

11

Hi Josh,

After adding ssl_insecure_skip_verify in dashboard and gateway server was still throwing error.

So have tried removing this configuration from dashboard conf only and restarted servers again.

Now both gateway and dashboard are up and running.

But when I am trying to open dashboard on browser, it is getting displayed as not secure site with https://

and while accessing API through postman, gateway is throwing below errors,
http: TLS handshake error from XX.XX.XX.XXX:49524: tls: first record does not look like a TLS handshake

12

Is the certificates portion of your config in your screenshot accurate or have you just added a placeholder for posting here?

In it you have it pointing at the certificate twice instead of to the cert and the key.

13

Hi Josh,

Since I have one pem format certificate, with cert and key concatenated into one.

If I give only certificate path , dashboard was throwing error, so have mentioned both cert and key pointing to same pem file

14

Hi @Josh

Mostly issues are resolved now, but when trying to access APIs on gateway with ssl enable with mutual tls,

getting below error,
{
“error”: “Certificate with SHA256 68e3606f61488e06d4753f9277b27a42d21e98bde35d7a357a6c977b5a1126f0 not allowed”
}

Client certificate is selfsigned certificate

Regards

15

Hello All,

Any suggestions on the above issue.

Regards.

16

Check if the cert you have imported has intermediate and root. Just have the leaf imported and try.