Set up Apollo-Router with TLS

[svx10]

I'm having some issues by setting up apollo-router 1.9.0 to work with TLS.

I tried to configure apollo-router using these configs:

tls:
  subgraph:
    subgraphs:
      spring-graphql-service:
        certificate_authorities: "/x/y/z/spring-graph-service_ca.pem"

I got this error in apollo-router:

"level":"ERROR","fields":{"message":"could not create router: could not load certificate authorities: the certificate list is empty"},"target":"apollo_router::executable"}
could not create router: could not load certificate authorities: the certificate list is empty

I have successfully validated the certificate path to make sure the certificate exists.

After that, I set the environment variable SSL_CERT_FILE to reference to the CA certificate path.

The previous error was gone, but then I started getting this error when I queried the graph router:

HTTP fetch failed from 'spring-graphql-service': HTTP fetch failed from 'spring-graphql-service': error trying to connect: invalid peer certificate contents: invalid peer certificate: CaUsedAsEndEntity

The certificate I'm using is being successfully used on other services, so the issue might be the way I'm trying to configure the usage of the cert on apollo-router or something miss configured on the spring-graphql-service.

I appreciate any hint to help me setting up the TLS properly between apollo-router and spring-graphql-service.

Thank you.

[garypen]

You have probably read the changelog notes, but on the off-chance that you didn't, there may be some useful information there.

Apart from that: 1.9.0 is quite old and we've fixed many issues since then. Maybe using a more up to date release would be helpful?