Summary
When Config.SSL is enabled, the leader dials each NodesKey peer over HTTPS using the entry's ip:port — for the health-check (/_pivot/version) and trigger-sync (/_pivot/synchronize/pivot). parseNodeAddr builds the address purely from ip+port, so the dial is https://<ip>:<port>/….
A peer whose TLS leaf is name-only (no IP SAN) cannot satisfy standard hostname verification against an IP literal. The handshake fails and the peer logs a continuous flood of:
http: TLS handshake error from <ip>: remote error: tls: bad certificate
This is common for internally-enrolled, DNS-named devices whose certificate carries only <name>.<internal-domain> (no IP SAN, by design). The peer is fully reachable and verifiable by name — only the raw-IP dial is wrong.
Impact
- Constant
tls: bad certificate log noise on every peer, every health-check interval.
- Forces consumers to work around it (e.g. dropping peers from
NodesKey entirely), which also removes the legitimate trigger-sync fan-out to those peers.
Expected
A way to have the leader dial peers by a DNS name (so the name-only leaf validates under ordinary hostname verification) without InsecureSkipVerify or mTLS, while preserving the default ip:port behavior for existing callers.
Proposed fix
Opt-in Config.NodeHostField: when set, parseNodeAddr uses that JSON field of a node entry as the dial host (per-entry fallback to ip when blank/absent); empty preserves current behavior. Implemented in #71.
Summary
When
Config.SSLis enabled, the leader dials eachNodesKeypeer over HTTPS using the entry'sip:port— for the health-check (/_pivot/version) and trigger-sync (/_pivot/synchronize/pivot).parseNodeAddrbuilds the address purely fromip+port, so the dial ishttps://<ip>:<port>/….A peer whose TLS leaf is name-only (no IP SAN) cannot satisfy standard hostname verification against an IP literal. The handshake fails and the peer logs a continuous flood of:
This is common for internally-enrolled, DNS-named devices whose certificate carries only
<name>.<internal-domain>(no IP SAN, by design). The peer is fully reachable and verifiable by name — only the raw-IP dial is wrong.Impact
tls: bad certificatelog noise on every peer, every health-check interval.NodesKeyentirely), which also removes the legitimate trigger-sync fan-out to those peers.Expected
A way to have the leader dial peers by a DNS name (so the name-only leaf validates under ordinary hostname verification) without
InsecureSkipVerifyor mTLS, while preserving the defaultip:portbehavior for existing callers.Proposed fix
Opt-in
Config.NodeHostField: when set,parseNodeAddruses that JSON field of a node entry as the dial host (per-entry fallback toipwhen blank/absent); empty preserves current behavior. Implemented in #71.