SSL between Sync Gateway and Couchbase Cluster

Mobile Sync Gateway
1

I need to get SSL communication working between my Sync Gateway instance and my Couchbase cluster. I have set up a certificate and I have my cluster listening on SSL on port 18091. I realize that this setup seems sort of trivial and maybe unnecessary, but I’m setting up a HIPAA compliant environment in AWS, and the terms of the AWS BAA dictate that all communication between AWS instances must be encrypted with SSL to be HIPAA compliant.

I’ve got the ‘databases’ section of my sync gateway config set up like this:

"databases": {
    "sync_gateway": {
        "server": "https://10.0.18.10:18091",
        "bucket": "sandbox_sync_gateway"
    }
}

However, when I start up the sync gateway, it just immediately attempts to connect on http and port 8091. It never tries SSL port 18091. I get a lot of error messages like this (because I have port 8091 closed. 18091 is open):

cberrorss.png952×133 31.9 KB

I saw this issue on the sync gateway Github. I commented on it a couple days ago. The gist of the issue is that the go-couchbase library didn’t support SSL connections as of February 2016.

However, it looks to me like SSL support was added to go-couchbase in this commit in March.

Can anyone comment on the status of SSL between SG and CB cluster as of Dec 2016? Does the sync gateway dependency on go-couchbase just need to be updated? Why was the status of that sync gateway issue changed to icebox a couple weeks ago?

2

What build of Sync Gateway are you running?

Sync Gateway 1.3.1 is built with a later commit of go-couchbase than the one you referenced, so I think we’d have that change.

3

I’m using 1.3.1. I should have mentioned that my original post. So I guess my sync gateway has that code in it. Hmm…

Any idea why this isn’t working for me? I can get a full copy of the logs if that helps, but it doesn’t even attempt to connect on port 18091 at all.

4

It looks like go-couchbase is failing on the bucket updater in particular (the bucketsStreaming endpoint) in particular. I don’t know whether that particular streaming endpoint is supported over SSL - I haven’t been able to find anything in the server docs.