"error":"remote error: tls: bad certificate" after regenerate cert using autobase/automation/roles/tls_certificate/generate/tasks/main.yml

[JY-210]

I am trying to regenerate cert with own CN and expiry date after the cluster is up. I configured ETCD file and Patroni config file to use the new cert generated. ETCD Peer connection works fine, but ETCD log will have bad certificate error, not sure the ports are for what services, it randomly change.

{"level":"warn","ts":"2025-07-14T17:40:59.974026+0800","caller":"embed/config_logging.go:170","msg":"rejected connection on client endpoint","remote-addr":"X.X.X.X:37694","server-name":"","error":"remote error: tls: bad certificate"}

{"level":"warn","ts":"2025-07-14T17:41:51.112921+0800","caller":"embed/config_logging.go:170","msg":"rejected connection on client endpoint","remote-addr":"X.X.X.X:38864","server-name":"","error":"remote error: tls: bad certificate"}

Any other services/files I need to modify to use the new cert? As I can't capture what is the client mentioned in ETCD log, but seems it is not from Patroni.

[vitabaks]

Any other services/files I need to modify to use the new cert?

This is most likely a Patroni service.

If you have changed the certificate manually, you will also need to copy it using this path: /etc/patroni/tls/etcd/

---

Free Support Discontinuation Notice

[JY-210]

I tried to add into /etc/patroni/tls/etcd/, changed owner to postgres, but still get bad certificate error at etcd log.

Master node manual and auto failover works fine with this error, although it shows rejected connection on client endpoint. So I am not sure if the client referring to Patroni.

Plus, when I sudo ss-tnp | grep patroni, the ports used by Patroni are not same with the ports in error log.

[vitabaks]

There are also services (depends on your scheme):

confd

• /etc/confd/tls/etcd

vip-manager

• /etc/patroni/tls/etcd/

You can also try etcd_client_cert_auth: false. Code here

[JY-210]

Found out it is vip-manager config missed out the new cert and key. Issue resolved now, thanks!