Connecting to ClickHouse®

• Can I connect to individual ClickHouse® hosts?

• Why cannot I connect to a host from the internet?

• How do I connect to a non-public host in Yandex Cloud?

• Can I connect to a public cluster without SSL?

• Why do I get an UNEXPECTED_PACKET_FROM_SERVER error when trying to connect?

• Can I connect to cluster hosts over SSH or get superuser privileges on hosts?

• What should I do if I get a revocation check error when using PowerShell to obtain an SSL certificate?

Can I connect to individual ClickHouse® hosts?Can I connect to individual ClickHouse® hosts?

Yes. You can connect to ClickHouse® cluster hosts:

• Using the HTTPS interface:

  • Via an encrypted SSL connection on port 8443.
  • Without encryption on port 8123.

• Using the command-line client:

  • Via an encrypted SSL connection on port 9440.
  • Without encryption on port 9000.

SSH connections are not supported.

Why cannot I connect to a host from the internet?Why cannot I connect to a host from the internet?

Most likely, no public access is enabled for your cluster, so you can only connect to it from a VM in Yandex Cloud. You can only request public access when creating a new host in your cluster.

How do I connect to a non-public host in Yandex Cloud?How do I connect to a non-public host in Yandex Cloud?

Connect to a host from a Yandex Cloud VM residing in the same cloud network, or add a new publicly accessible host to the cluster and use it to connect to the non-public host.

Can I connect to a public cluster without SSL?Can I connect to a public cluster without SSL?

No. You can only connect to public hosts over SSL. For more information, see this guide.

Why do I get an error when trying to connect?Why do I get an UNEXPECTED_PACKET_FROM_SERVER error when trying to connect?

Here is the full text of the error:

Code: 102. DB::NetException:
Unexpected packet from server <host_FQDN>.mdb.yandexcloud.net:9440
(expected Hello or Exception, got Unknown packet)

This error occurs when you try to connect to a ClickHouse® host on port 9440 without encryption. You can only connect on port 9440 over an encrypted SSL connection.

Make sure to specify the --secure parameter when connecting on port 9440.

To learn more about connection methods, see Connecting to a ClickHouse® cluster.

Can I connect to cluster hosts over SSH or get superuser privileges on hosts?Can I connect to cluster hosts over SSH or get superuser privileges on hosts?

You cannot connect to hosts via SSH. This is done for the sake of security and user cluster fault tolerance because direct changes inside a host can render it completely inoperable.

What should I do if I get a revocation check error when using PowerShell to obtain an SSL certificate?What should I do if I get a revocation check error when using PowerShell to obtain an SSL certificate?

Here is the full text of the error:

curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012)
The revocation function was unable to check revocation for the certificate

This means that the service was unable to verify the website certificate against the revocation list when trying to connect.

To fix this error:

• Make sure your corporate network policies are not blocking the verification.

• Run the following command with the --ssl-no-revoke parameter:

  mkdir -Force $HOME\.yandex; `
  curl.exe https://storage.yandexcloud.net/cloud-certs/RootCA.pem `
    --ssl-no-revoke `
    --output $HOME\.yandex\RootCA.crt; `
  curl.exe https://storage.yandexcloud.net/cloud-certs/IntermediateCA.pem `
    --ssl-no-revoke `
    --output $HOME\.yandex\IntermediateCA.crt; `
  Import-Certificate `
    -FilePath $HOME\.yandex\RootCA.crt `
    -CertStoreLocation cert:\CurrentUser\Root; `
  Import-Certificate `
    -FilePath $HOME\.yandex\IntermediateCA.crt `
    -CertStoreLocation cert:\CurrentUser\Root
  

ClickHouse® is a registered trademark of ClickHouse, Inc.