Connecting to ClickHouse®

• Can I connect to individual ClickHouse® hosts?

• Why canot I connect to a host from the internet?

• How do I connect to a non-public host in Yandex Cloud?

• Can I connect to a public cluster without SSL?

• Why do I get an UNEXPECTED_PACKET_FROM_SERVER error when connecting?

• Can I connect to cluster hosts via SSH or get superuser permissions on hosts?

• What do I do if I get the revocation check error when using PowerShell to obtain an SSL certificate?

Can I connect to individual ClickHouse® hosts?Can I connect to individual ClickHouse® hosts?

Yes. You can connect to ClickHouse® cluster hosts:

• Using the HTTPS interface:

  • Via an encrypted SSL connection on port 8443.
  • Without encryption through port 8123.

• Using the command-line client:

  • Via an encrypted SSL connection on port 9440.
  • Without encryption through port 9000.

SSH connections are not supported.

Why cannot I connect to a host from the internet?Why cannot I connect to a host from the internet?

Most likely, no public access is enabled for the cluster, so you can only connect to it from a VM in Yandex Cloud. You can only request public access when creating a new host in your cluster.

How do I connect to a non-public host in Yandex Cloud?How do I connect to a non-public host in Yandex Cloud?

Connect to a host from a VM in Yandex Cloud hosted in the same cloud network, or add a new cluster host with public access and connect to a non-public host through it.

Can I connect to a public cluster without SSL?Can I connect to a public cluster without SSL?

No. You can only connect to public hosts using an SSL connection. For more information, see the documentation.

Why do I get an error when connecting?Why do I get an UNEXPECTED_PACKET_FROM_SERVER error when connecting?

Here is the full text of the error:

Code: 102. DB::NetException:
Unexpected packet from server <host_FQDN>.mdb.yandexcloud.net:9440
(expected Hello or Exception, got Unknown packet)

This error occurs when you try to connect directly to the ClickHouse® host through port 9440 without using encryption. You can only connect through port 9440 over an encrypted SSL connection.

Make sure to specify the --secure parameter when connecting through port 9440.

To learn more about connection methods, see Connecting to a ClickHouse® cluster.

Can I connect to cluster hosts via SSH or get superuser permissions on hosts?Can I connect to cluster hosts via SSH or get superuser permissions on hosts?

You cannot connect to hosts via SSH. This is done for the sake of security and user cluster fault tolerance because direct changes inside a host can render it completely inoperable.

What should I do if I get the revocation check error when using PowerShell to obtain an SSL certificate?What should I do if I get the revocation check error when using PowerShell to obtain an SSL certificate?

Here is the full text of the error:

curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012)
The revocation function was unable to check revocation for the certificate

This means, when connecting to the website, the service was unable to check whether or not its certificate was listed among revoked ones.

To fix this error:

• Make sure the corporate network settings do not block the check.

• Run the command with the --ssl-no-revoke parameter.

  mkdir -Force $HOME\.yandex; `
  curl.exe https://storage.yandexcloud.net/cloud-certs/RootCA.pem `
    --ssl-no-revoke `
    --output $HOME\.yandex\RootCA.crt; `
  curl.exe https://storage.yandexcloud.net/cloud-certs/IntermediateCA.pem `
    --ssl-no-revoke `
    --output $HOME\.yandex\IntermediateCA.crt; `
  Import-Certificate `
    -FilePath $HOME\.yandex\RootCA.crt `
    -CertStoreLocation cert:\CurrentUser\Root; `
  Import-Certificate `
    -FilePath $HOME\.yandex\IntermediateCA.crt `
    -CertStoreLocation cert:\CurrentUser\Root
  

ClickHouse® is a registered trademark of ClickHouse, Inc.