t8y2/dbx · error

TDengine Rust WebSocket connector does not support client ce

Error message

TDengine Rust WebSocket connector does not support client certificate authentication

What it means

build_dsn constructs the WebSocket connection string for the TDengine driver. The Rust WebSocket connector does not implement mutual TLS (client certificates), so supplying a client cert or key path is rejected up front instead of being silently ignored. This is a fail-fast guard for unsupported configuration.

Source

Thrown at agents/drivers/tdengine/src/config.rs:21

use std::net::IpAddr;
use url::Url;

use crate::model::ConnectParams;

const DEFAULT_HOST: &str = "127.0.0.1";
const DEFAULT_PORT: u16 = 6041;
const DEFAULT_USER: &str = "root";
const DEFAULT_PASSWORD: &str = "taosdata";

#[derive(Debug)]
pub struct BuiltDsn {
    pub value: String,
    pub database: String,
}

pub fn build_dsn(params: &ConnectParams) -> Result<BuiltDsn> {
    if !params.client_cert_path.trim().is_empty() || !params.client_key_path.trim().is_empty() {
        bail!("TDengine Rust WebSocket connector does not support client certificate authentication");
    }

    let mut url = if params.connection_string.trim().is_empty() {
        build_from_fields(params)?
    } else {
        normalize_connection_string(params.connection_string.trim(), params.ssl)?
    };

    apply_connection_fields(&mut url, params)?;
    merge_query_params(&mut url, &params.url_params);
    if (params.ssl || !params.ca_cert_path.trim().is_empty()) && url.scheme() == "ws" {
        url.set_scheme("wss").map_err(|_| anyhow::anyhow!("failed to enable TLS in TDengine connection URL"))?;
    }
    if !params.ca_cert_path.trim().is_empty() {
        set_query_param(&mut url, "tls_mode", "verify_identity");
        set_query_param(&mut url, "tls_ca", params.ca_cert_path.trim());
    }
    let database = url

View on GitHub (pinned to c0390bff16)

Solutions

1. Remove the client_cert_path/client_key_path values from the connection params
2. Use the TDengine native (non-WebSocket) connector if mutual TLS is required
3. Keep TLS server verification via the CA path only (ca certificate support is accepted for WebSocket)

Example fix

// before
params.client_cert_path = "/etc/certs/client.pem".into();
// after (WS connector: no client cert)
params.client_cert_path = "".into();
params.client_key_path = "".into();
params.ca_cert_path = "/etc/certs/ca.pem".into();

if !params.client_cert_path.trim().is_empty() || !params.client_key_path.trim().is_empty() {
    return Err(anyhow!("mTLS is not supported by the WebSocket connector; drop client cert/key or use the native connector"));
}

fn is_ws_compatible_tls(p: &ConnectParams) -> bool {
    p.client_cert_path.trim().is_empty() && p.client_key_path.trim().is_empty()
}

match build_dsn(&params) {
    Err(e) if e.to_string().contains("client certificate") => configure_native_connector_or_drop_mtls(),
    Err(e) => return Err(e),
    Ok(dsn) => connect(dsn),
}

When it happens

Trigger: Calling build_dsn (via connect) with ConnectParams where client_cert_path or client_key_path is non-empty after trimming — e.g. configuring mTLS fields in the TDengine agent connection settings.

Common situations: Copying a JDBC or native-connector config that uses mutual TLS, or security teams mandating client certs; users assume the WebSocket connector supports mTLS like other drivers.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Client certificate and key must be provided together
• Client certificate and key must be provided together
• both client_cert_path and client_key_path are required for I
• TDengine native agent supports only WebSocket connection str
• Client certificate and key must be provided together

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/42b9bbd6fe7357fb. Report an issue: GitHub.