PG::ConnectionBad: PQconsumeInput() SSL error: key

问题:

When I open a certificate with OpenSSL::PKCS12, I lose the connection with my database and occur the error: PG::ConnectionBad: PQconsumeInput() SSL error: key values mismatch.

I'm doing this:

myuser@developer:~/myapp$ rails c

2.2.3 :001 > OpenSSL::PKCS12.new File.read('/local/to/mycert.pfx'), 'PASSWORD'
=> #<OpenSSL::PKCS12:0x000000072e6808 @key=#<OpenSSL::PKey::RSA:0x000000072e67e0>, @certificate=#<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000072e6100>, issuer=#<OpenSSL::X509::Name:0x000000072e6128>, serial=#<OpenSSL::BN:0x000000072e6150>, not_before=2014-12-18 19:15:55 UTC, not_after=2015-12-18 19:15:55 UTC>, 
@ca_certs=[#<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000072e5c78>, issuer=#<OpenSSL::X509::Name:0x000000072e5ca0>, serial=#<OpenSSL::BN:0x000000072e5cc8>, not_before=2014-08-04 18:38:36 UTC, not_after=2021-10-11 18:38:36 UTC>, #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000072e5818>, issuer=#<OpenSSL::X509::Name:0x000000072e5840>, serial=#<OpenSSL::BN:0x000000072e5868>, not_before=2011-10-21 12:16:29 UTC, not_after=2021-10-21 12:16:29 UTC>, #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000072e52f0>, issuer=#<OpenSSL::X509::Name:0x000000072e5318>, serial=#<OpenSSL::BN:0x000000072e5340>, not_before=2010-06-21 19:04:57 UTC, not_after=2023-06-21 19:04:57 UTC>]>

After this I lose the connection:

2.2.3 :002 > Company.last
PG::ConnectionBad: PQconsumeInput() SSL error: key values mismatch
:             SELECT tablename
            FROM pg_tables
            WHERE schemaname = ANY (current_schemas(false))

ActiveRecord::StatementInvalid: PG::ConnectionBad: PQconsumeInput() SSL error: key values mismatch
:             SELECT tablename
            FROM pg_tables
            WHERE schemaname = ANY (current_schemas(false))

    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/postgresql/database_statements.rb:147:in `async_exec'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/postgresql/database_statements.rb:147:in `block in query'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/abstract_adapter.rb:473:in `block in log'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activesupport-4.2.4/lib/active_support/notifications/instrumenter.rb:20:in `instrument'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/abstract_adapter.rb:467:in `log'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/postgresql/database_statements.rb:146:in `query'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/postgresql/schema_statements.rb:91:in `tables'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/schema_cache.rb:90:in `prepare_tables'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/connection_adapters/schema_cache.rb:22:in `table_exists?'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/model_schema.rb:230:in `table_exists?'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/attribute_methods/primary_key.rb:97:in `get_primary_key'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/attribute_methods/primary_key.rb:85:in `reset_primary_key'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/attribute_methods/primary_key.rb:73:in `primary_key'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/attribute_methods/primary_key.rb:80:in `quoted_primary_key'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/delegation.rb:48:in `quoted_primary_key'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/query_methods.rb:1078:in `reverse_sql_order'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/query_methods.rb:852:in `reverse_order!'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/query_methods.rb:846:in `reverse_order'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/finder_methods.rb:511:in `find_last'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/relation/finder_methods.rb:160:in `last'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/activerecord-4.2.4/lib/active_record/querying.rb:3:in `last'
    from (irb):2
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/railties-4.2.4/lib/rails/commands/console.rb:110:in `start'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/railties-4.2.4/lib/rails/commands/console.rb:9:in `start'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/railties-4.2.4/lib/rails/commands/commands_tasks.rb:68:in `console'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/railties-4.2.4/lib/rails/commands/commands_tasks.rb:39:in `run_command!'
    from /home/myuser/.rvm/gems/ruby-2.2.3/gems/railties-4.2.4/lib/rails/commands.rb:17:in `<top (required)>'
    from bin/rails:4:in `require'
    from bin/rails:4:in `<main>'2.2.3 :003 >

I perceive that this occurs when the method ca_certs is not null.

Ruby version: 2.2.3
Rails version: 4.2.4
gem 'pg', '0.18.3'

Has anyone had this problem?

回答1:

I encountered this same problem today. After a long search I came across this thread. Seems like a bug in OpenSSL library/extension. Because opening a certificate and talking to a DB happen in a single thread, the connection gets screwed up. I still haven't figured out all details but a workaround is to open the certificate in it's own thread, like:

pkcs = nil
Thread.new { pkcs = OpenSSL::PKCS12.new File.read('/local/to/mycert.pfx'), 'PASSWORD' }.join

Hope that helps :)