# Connection error in secure mode **URL:** \ **Category:** Flower Help - Beginners\ **Created:** [November 18, 2024, 1:03pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424 "2024-11-18T13:03:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vagzikopis](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vagzikopis](https://discuss.flower.ai/u/vagzikopis)\ **Post date:** [November 18, 2024, 1:03pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/1 "2024-11-18T13:03:29Z")
Hi, I’m trying to execute a local deployment with **–insecure** option **False**. When --insecure is True everything works as expected. My docker compose-file looks like the following: ```auto services: # create a SuperLink service superlink: image: flwr/superlink:${FLWR_VERSION:-1.12.0} command: # --insecure --ssl-ca-certfile=certificates/ca.crt --ssl-certfile=certificates/server.pem --ssl-keyfile=certificates/server.key volumes: - .cache/certificates:/app/certificates:ro # create a SuperExec service superexec: build: context: ${PROJECT_DIR:-.} dockerfile_inline: | FROM flwr/superexec:${FLWR_VERSION:-1.12.0} # gcc is required for the fastai quickstart example USER root RUN apt-get update \ && apt-get -y --no-install-recommends install \ build-essential \ && rm -rf /var/lib/apt/lists/* USER app WORKDIR /app COPY --chown=app:app pyproject.toml . RUN sed -i 's/.*flwr\[simulation\].*//' pyproject.toml \ && python -m pip install -U --no-cache-dir . ENTRYPOINT ["flower-superexec"] ports: - 9093:9093 command: - --executor - flwr.superexec.deployment:executor # - --insecure - --executor-config - superlink="superlink:9091" - --ssl-ca-certfile=certificates/ca.crt - --ssl-certfile=certificates/server.pem - --ssl-keyfile=certificates/server.key depends_on: - superlink volumes: - .cache/certificates:/app/certificates:ro # create a two SuperNode service with different node configs supernode-1: image: flwr/supernode:${FLWR_VERSION:-1.12.0} command: # - --insecure - --superlink - superlink:9092 - --supernode-address - 0.0.0.0:9094 - --isolation - process - --node-config - "partition-id=0 num-partitions=2" - --root-certificates=certificates/ca.crt depends_on: - superlink volumes: - .cache/certificates:/app/certificates:ro supernode-2: image: flwr/supernode:${FLWR_VERSION:-1.12.0} command: # - --insecure - --superlink - superlink:9092 - --supernode-address - 0.0.0.0:9095 - --isolation - process - --node-config - "partition-id=1 num-partitions=2" - --root-certificates=certificates/ca.crt depends_on: - superlink volumes: - .cache/certificates:/app/certificates:ro ``` The problem is that when I run `docker compose up --build -d` I see the following: - Superlink ```auto 2024-11-18 12:03:26 INFO : Starting Flower SuperLink 2024-11-18 12:03:26 INFO : Flower ECE: Starting Driver API (gRPC-rere) on 0.0.0.0:9091 2024-11-18 12:03:26 INFO : Flower ECE: Starting Fleet API (gRPC-rere) on 0.0.0.0:9092 2024-11-18 12:03:27 WARNING: All log messages before absl::InitializeLog() is called are written to STDERR 2024-11-18 12:03:27 E0000 00:00:1731924207.239103 26 ssl_transport_security.cc:2128] No match found for server name: superlink 2024-11-18 12:03:27 E0000 00:00:1731924207.240866 30 ssl_transport_security.cc:2128] No match found for server name: superlink ``` - Supernode ```auto 2024-11-18 11:55:54 INFO : Starting Flower SuperNode 2024-11-18 11:55:55 INFO : Starting Flower ClientAppIo gRPC server on 0.0.0.0:9094 2024-11-18 11:55:55 WARNING : Connection attempt failed, retrying... 2024-11-18 11:55:55 WARNING : Connection attempt failed, retrying in 0.81 seconds 2024-11-18 11:55:56 WARNING : Connection attempt failed, retrying in 2.58 seconds ``` I have manually checked that the certificates are mounted to the created containers. ---
**Author:** ![adam-narozniak](https://dub1.discourse-cdn.com/flex013/user_avatar/discuss.flower.ai/adam-narozniak/32/33_2.png) [@adam-narozniak](https://discuss.flower.ai/u/adam-narozniak)\ **Post date:** [November 18, 2024, 2:19pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/2 "2024-11-18T14:19:51Z")
Hi, What version of Flower did you use? ---
**Author:** ![vagzikopis](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vagzikopis](https://discuss.flower.ai/u/vagzikopis)\ **Post date:** [November 18, 2024, 2:32pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/3 "2024-11-18T14:32:43Z")
Hi! I’m using 1.12.0. ---
**Author:** ![robert](https://dub1.discourse-cdn.com/flex013/user_avatar/discuss.flower.ai/robert/32/138_2.png) [@robert](https://discuss.flower.ai/u/robert)\ **Post date:** [November 19, 2024, 12:55pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/4 "2024-11-19T12:55:55Z")
Hey @vagzikopis , Welcome to the Flower Discuss! At first glance, your Docker Compose file looks fine. However, there’s a small issue: the SuperExec does not use the SuperLink certificate to validate the SuperLink identity. I’m guessing you’re using the same set of certificates and keys for both SuperLink and SuperExec, is that correct? If that’s the case, you’ll need to replace the line in the SuperExec service: ```yaml - superlink="superlink:9091" ``` with: ```yaml - superlink="superlink:9091" root-certificates="certificates/ca.crt" ``` However, this change alone will not resolve your error. Are you using the Docker Compose command described in [this section](https://flower.ai/docs/framework/docker/tutorial-quickstart-docker-compose.html#step-6-run-flower-with-tls) to generate the certificates? My guess is that the certificate does not include the DNS name `superlink` as a Subject Alternative Name (SAN). I recommend checking out the [Quickstart with Docker Compose guide](https://flower.ai/docs/framework/docker/tutorial-quickstart-docker-compose.html#quickstart-with-docker-compose) and this [certs.yml](https://github.com/adap/flower/blob/24b2861465431a5ab234a8c4f76faea7a742b1fd/src/docker/complete/certs.yml#L34) to see how to set the SAN. Let me know if this helps! ---
**Author:** ![vagzikopis](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vagzikopis](https://discuss.flower.ai/u/vagzikopis)\ **Post date:** [November 27, 2024, 11:23am UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/5 "2024-11-27T11:23:59Z")
Hey @robert. Thanks for replying back to my question, your instructions have helped me move forward. But now I have another issue. I followed the commands from [this link](https://flower.ai/docs/framework/docker/tutorial-quickstart-docker-compose.html#step-6-run-flower-with-tls) and the compose files from [here](https://github.com/adap/flower/tree/24b2861465431a5ab234a8c4f76faea7a742b1fd/src/docker/complete) and now I don’t get any errors during the build of the containers. However, when I execute the `flwr run . local-deployment --stream` I get the following error : ```auto _InactiveRpcError: <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAVAILABLE details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:9093: Ssl handshake failed (TSI_PROTOCOL_FAILURE): SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED" debug_error_string = "UNKNOWN:Error received from peer {created_time:"2024-11-27T13:18:50.69710094+02:00", grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:9093: Ssl handshake failed (TSI_PROTOCOL_FAILURE): SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED"}" > E0000 00:00:1732706340.595075 1726 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706350.594511 1720 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706360.593597 1728 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706370.593564 1724 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706380.592757 1721 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706390.592663 1723 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706405.591836 1720 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706430.591835 1722 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706475.589544 1727 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED E0000 00:00:1732706535.587665 1721 ssl_transport_security.cc:1654] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED ``` Do you have any thoughts on this one ? ---
**Author:** ![vagzikopis](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vagzikopis](https://discuss.flower.ai/u/vagzikopis)\ **Post date:** [November 28, 2024, 11:18am UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/6 "2024-11-28T11:18:26Z")
### Update I get the same error when I follow the commands from [this link](https://flower.ai/docs/framework/docker/tutorial-quickstart-docker-compose.html#step-6-run-flower-with-tls). I just used the latest versions of the **.yml** files from [here](https://github.com/adap/flower/tree/24b2861465431a5ab234a8c4f76faea7a742b1fd/src/docker/complete). Could it be that something is outdated or that I’m using a wrong version of something ? ---
**Author:** ![robert](https://dub1.discourse-cdn.com/flex013/user_avatar/discuss.flower.ai/robert/32/138_2.png) [@robert](https://discuss.flower.ai/u/robert)\ **Post date:** [November 28, 2024, 7:11pm UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/7 "2024-11-28T19:11:29Z")
Hi @vagzikopis , It seems your Docker Compose setup might be outdated compared to the one used in the quickstart example. Try updating the root-certificates value in your pyproject.toml to: ```toml [tool.flwr.federations.local-deployment-tls] address = "127.0.0.1:9093" root-certificates = "../superexec-certificates/ca.crt" ``` Alternatively, use the latest Docker Compose setup by cloning the Flower repository with the tag [v1.13.1](https://flower.ai/docs/framework/docker/tutorial-quickstart-docker-compose.html#step-1-set-up). If you choose this option, also update the Flower CLI to version 1.13.1: ```bash pip uninstall flwr pip install flwr==1.13.1 ``` Let us know if this resolves the issue! ---
**Author:** ![vagzikopis](https://avatars.discourse-cdn.com/v4/letter/v/9de0a6/32.png) [@vagzikopis](https://discuss.flower.ai/u/vagzikopis)\ **Post date:** [December 3, 2024, 10:50am UTC](https://discuss.flower.ai/t/connection-error-in-secure-mode/424/8 "2024-12-03T10:50:16Z")
Hi @robert. After following your instructions and using the latest Docker compose and version 1.13.1 I get the following error in the local-deployment-tls (local-deployment works as expected). ```auto Traceback (most recent call last): File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/bin/flwr", line 5, in from flwr.cli.app import app File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/ __init__.py", line 20, in from . import client, common, server, simulation File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/simulation/ __init__.py", line 20, in from flwr.simulation.app import run_simulation_process File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/simulation/app.py", line 65, in from flwr.server.superlink.fleet.vce.backend.backend import BackendConfig File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/server/superlink/fleet/vce/ __init__.py", line 17, in from .vce_api import start_vce File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/server/superlink/fleet/vce/vce_api.py", line 45, in from .backend import Backend, error_messages_backends, supported_backends File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/server/superlink/fleet/vce/backend/ __init__.py", line 30, in from .raybackend import RayBackend File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/flwr/server/superlink/fleet/vce/backend/raybackend.py", line 21, in import ray File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/ray/ __init__.py", line 112, in from ray._private.worker import ( # noqa: E402,F401 File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/ray/_private/worker.py", line 74, in from ray._private.runtime_env.py_modules import upload_py_modules_if_needed File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/ray/_private/runtime_env/py_modules.py", line 23, in from ray._private.runtime_env.working_dir import set_pythonpath_in_context File "/mnt/c/Users/zikopis/Documents/Py3.10.12WSLEnv/lib/python3.10/site-packages/ray/_private/runtime_env/working_dir.py", line 31, in scratch_dir: Optional[str] = os.getcwd(), FileNotFoundError: [Errno 2] No such file or directory ``` This is my **compose.yml** file: ```docker services: # create a SuperLink service superlink: image: flwr/superlink:${FLWR_VERSION:-1.13.1} command: - --insecure - --isolation - process ports: - 9093:9093 # create a ServerApp service serverapp: build: context: ${PROJECT_DIR:-.} dockerfile_inline: | FROM flwr/serverapp:${FLWR_VERSION:-1.13.1} # gcc is required for the fastai quickstart example USER root RUN apt-get update \ && apt-get -y --no-install-recommends install \ build-essential \ && rm -rf /var/lib/apt/lists/* USER app WORKDIR /app COPY --chown=app:app pyproject.toml . RUN sed -i 's/.*flwr\[simulation\].*//' pyproject.toml \ && python -m pip install -U --no-cache-dir . ENTRYPOINT ["flwr-serverapp"] command: - --insecure - --serverappio-api-address - superlink:9091 restart: on-failure:3 depends_on: - superlink # create a two SuperNode service with different node configs supernode-1: image: flwr/supernode:${FLWR_VERSION:-1.13.1} command: - --insecure - --superlink - superlink:9092 - --clientappio-api-address - 0.0.0.0:9094 - --isolation - process - --node-config - "partition-id=0 num-partitions=2" depends_on: - superlink supernode-2: image: flwr/supernode:${FLWR_VERSION:-1.13.1} command: - --insecure - --superlink - superlink:9092 - --clientappio-api-address - 0.0.0.0:9095 - --isolation - process - --node-config - "partition-id=1 num-partitions=2" depends_on: - superlink clientapp-1: build: context: ${PROJECT_DIR:-.} dockerfile_inline: | FROM flwr/clientapp:${FLWR_VERSION:-1.13.1} # gcc is required for the fastai quickstart example USER root RUN apt-get update \ && apt-get -y --no-install-recommends install \ build-essential \ && rm -rf /var/lib/apt/lists/* USER app WORKDIR /app COPY --chown=app:app pyproject.toml . RUN sed -i 's/.*flwr\[simulation\].*//' pyproject.toml \ && python -m pip install -U --no-cache-dir . ENTRYPOINT ["flwr-clientapp"] command: - --insecure - --clientappio-api-address - supernode-1:9094 deploy: resources: limits: cpus: "2" stop_signal: SIGINT depends_on: - supernode-1 volumes: - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant1.csv:/app/participant1.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant2.csv:/app/participant2.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant3.csv:/app/participant3.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant4.csv:/app/participant4.csv:ro clientapp-2: build: context: ${PROJECT_DIR:-.} dockerfile_inline: | FROM flwr/clientapp:${FLWR_VERSION:-1.13.1} # gcc is required for the fastai quickstart example USER root RUN apt-get update \ && apt-get -y --no-install-recommends install \ build-essential \ && rm -rf /var/lib/apt/lists/* USER app WORKDIR /app COPY --chown=app:app pyproject.toml . RUN sed -i 's/.*flwr\[simulation\].*//' pyproject.toml \ && python -m pip install -U --no-cache-dir . ENTRYPOINT ["flwr-clientapp"] command: - --insecure - --clientappio-api-address - supernode-2:9095 deploy: resources: limits: cpus: "2" stop_signal: SIGINT depends_on: - supernode-2 volumes: - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant1.csv:/app/participant1.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant2.csv:/app/participant2.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant3.csv:/app/participant3.csv:ro - /mnt/c/Users/zikopis/Documents/GitHub/complete/fpdm/data/participant4.csv:/app/participant4.csv:ro ```