Validator api requires ssl keystore to be defined

Description

[Detailed description of the problem and the impact it has] [Please be as specific as possible] Starting teku in “web3signer mode” with validator API enabled (and all the other required flags) result in an error if not tls keys are defined (probably with --validators-external-signer-keystore)

However starting teku in “web3signer mode” without the validator API enabled and without the tls keys setup, is allowed.

Steps to Reproduce (Bug)

Start Teku with

/opt/teku/bin/teku validator-client --network=auto --data-base-path=/opt/teku/data \
     --beacon-node-api-endpoint=%(ENV_BEACON_NODE_ADDR)s \
     --validators-external-signer-url=%(ENV_WEB3SIGNER_API)s --log-destination=CONSOLE \ 
     --metrics-enabled=true --metrics-interface 0.0.0.0 --metrics-port 8008 \ 
     --metrics-host-allowlist=* --validator-api-enabled=true \ 
     --validator-api-interface=0.0.0.0 --validator-api-port=%(ENV_VALIDATOR_PORT)s \ 
     --validator-api-host-allowlist=0.0.0.0 %(ENV_EXTRA_OPTS)s

Expected behavior: [What you expect to happen] Allow starting teku in web3signer mode with validator API enabled without tls configured Actual behavior: [What actually happens] Error

Validator api requires ssl keystore to be defined

Frequency: [How regularly does it occur?] On startup

Versions (Add all that apply)

• Software version: [teku --version or look for log lines starting with Teku version:] 22.4.0
• Java version: [java -version] official docker image
• OS Name & Version: [cat /etc/*release] official docker image
• Docker Version: [docker version] 20.10.2
• Cloud VM, type, size: [Amazon Web Services I3-large]

[ajsutton]

Actually Enrico has a good point too I think the cert format is probably not what Teku needs either. The instructions for creating a keystore for use with web3signer also work for this: https://docs.teku.consensys.net/en/latest/Tutorials/Configure-External-Signer-TLS/

[ajsutton]

It’s the password.txt that’s binary which is specified as:

--validator-api-keystore-password-file=/usr/local/share/ca-certificates/password.txt

according to the link you gave. It needs to be valid UTF-8. The failed to start Javalin is the issue we need to get rid of, though for me I get a big exception stack trace earlier which gives a clear message about what’s wrong:

2022-04-29 08:54:14.279 ERROR - Failed to read password file for validator api keystore
java.nio.charset.MalformedInputException: Input length = 3
at java.lang.String.throwMalformed(String.java:1240) ~[?:?]
at java.lang.String.decodeUTF8_UTF16(String.java:1122) ~[?:?]
at java.lang.String.newStringUTF8NoRepl(String.java:728) ~[?:?]
at java.lang.String.newStringNoRepl1(String.java:756) ~[?:?]
at java.lang.String.newStringNoRepl(String.java:738) ~[?:?]
...

The reason you’re getting no response is an artefact of using Docker - Teku isn’t listening on the port at all so it’s not even accepting the connection, but Docker’s port forwarding does accept the connection then finds it can’t connect the other end and just does nothing with it.