tls: failed to parse certificate from server: x509: negative serial number

[Eraser3]

Relevant telegraf.conf

[[inputs.sqlserver]]
  servers = [
    "Server=127.0.0.1;Port=1433;User Id=telegraf;Password=<HIDDEN>;Database=<MyDatabase>;app name=telegraf;log=1;TrustServerCertificate=1;",
  ]

  query_timeout = "10s"
  database_type = "SQLServer"
  include_query = ["SQLServerPerformanceCounters", "SQLServerRequests"]
  exclude_query = ["SQLServerAvailabilityReplicaStates", "SQLServerDatabaseReplicaStates"]

Logs from Telegraf

Dec 15 14:18:30 sql-02 telegraf[11607]: 2024-12-15T13:18:30Z E! [inputs.sqlserver] Error in plugin: query SQLServerRequests failed for server: 127.0.0.1 and database: <MyDatabase> with Error: TLS Handshake failed: tls: failed to parse certificate from server: x509: negative serial number
Dec 15 14:18:30 sql-02 telegraf[11607]: 2024-12-15T13:18:30Z E! [inputs.sqlserver] Error in plugin: query SQLServerPerformanceCounters failed for server: 127.0.0.1 and database: <MyDatabase> with Error: TLS Handshake failed: tls: failed to parse certificate from server: x509: negative serial number

System info

Telegraf 1.33.0, Ubuntu 20.04.6 LTS, Microsoft SQL Server 2019 (RTM-CU30) (KB5049235) - 15.0.4415.2 (X64) Standard Edition (64-bit)

Docker

No response

Steps to reproduce

1. Install SQL Server 2019
2. Configure Telegraf sqlserver input
3. Run Telegraf

Expected behavior

Telegraf to successfully connect with SQL Server.

Actual behavior

Telegraf fails the SQL Server TLS handshake because of the X509 negative serial number.

Additional info

No response

[jminardi]

I have this same issue when trying to connect to kepware.

I believe telegraf is interpreting the serial number as a signed int, when its intended to be an unsigned int.

I've exported the cert and inspected it on my Mac. There serial number is listed as a large positive integer. (large enough to cause an overflow if interpreted as an int32)

How can we get telegraf to interpret the serial numbers as uint32s?

[jminardi]

I've got a workaround to this problem. Set the following env var to get the go cert library to ignore the negative serial number error: GODEBUG=x509negativeserial=1

[DStrand1]

@Eraser3 and @jminardi, I created an issue for upstream Go here: golang/go#71606, could you provide any further context on your issue there, and post the output of the affected certificate chain?

[srebhan]

Closing this issue as PR #16489 should got you covered. We need to remove the workaround iff the Golang devs decide to do something about it.