0

I've been trying to install a custom CA into some Alpine Linux container.

First I would add the public key in /usr/local/share/ca-certificates, then run update-ca-certificates.

$ ls -l /usr/local/share/ca-certificates/
total 4
-rw-r--r--    1 root     root          2029 Feb 20 18:39 my-custom-ca.crt
$ update-ca-certificates
...

$ ls -ltr /etc/ssl/certs | tail -3
-rw-r--r--    1 1000     root        233441 Feb 20 18:52 ca-certificates.crt
lrwxrwxrwx    1 1000     root            49 Feb 20 18:52 ca-cert-my-custom-ca.pem -> /usr/local/share/ca-certificates/my-custom-ca.crt
lrwxrwxrwx    1 1000     root            24 Feb 20 18:52 51252b35.0 -> ca-cert-my-custom-ca.pem

Yet this does not seem to work completely.

Sure, I can confirm the certificate is trusted by OpenSSL:

$ openssl s_client -connect <my-server-crt-cn>:443 -showcerts 
CONNECTED(00000003)
depth=1 C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-ca-name>
verify return:1
depth=0 C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-server-crt-cn>
verify return:1
---
Certificate chain
 0 s:C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-server-crt-cn>
   i:C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-ca-name>
...

    Start Time: 1613847660
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no

Yet, other tools such as wget, or the ruby app I'm trying to run, do not seem to care:

$ wget https://<my-server-crt-cn>/
ssl_client: <my-server-crt-cn>: certificate verification failed: self signed certificate in certificate chain
wget: error getting response: Connection reset by peer

$ wget --no-check-certificate https://<my-server-crt-cn> -O-
Connecting to <my-server-crt-cn> (10.42.253.168:443)
writing to stdout
<response>
<returncode>SUCCESS</returncode>
<version>2.0</version>

I can reproduce building the following image:

FROM docker.io/alpine:3.11
RUN apk add --no-cache \
    ca-certificates \
    openssl
COPY my-ca.crt /usr/local/share/ca-certificates

Testing on my workstation (Debian), I have no troubles at all, once the CA is trusted I can use wget/curl without ignoring tls errors.

Did I do something wrong? Why would wget or ruby keep complaining about my certificate being self-signed?

1

Apparently, my issue lies with the wget shipping with Apline.

By default, Alpine comes with a wget from busybox:

/ $ wget --version
wget: unrecognized option: version
BusyBox v1.31.1 () multi-call binary.

If I patch my Dockerfile to install wget, alongside ca-certificates, then I can connect without warning nor skipping certificates verification.

0

IMO it's because busybox wget in Alpine Linux is patched to require external executable ssl_client which handles HTTPS, see https://gitlab.alpinelinux.org/alpine/aports/-/commit/1d0560a9b6b5597b191e5aff69a31c2fe0aba273

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.