I've been trying to install a custom CA into some Alpine Linux container.
First I would add the public key in
/usr/local/share/ca-certificates, then run
$ ls -l /usr/local/share/ca-certificates/ total 4 -rw-r--r-- 1 root root 2029 Feb 20 18:39 my-custom-ca.crt $ update-ca-certificates ... $ ls -ltr /etc/ssl/certs | tail -3 -rw-r--r-- 1 1000 root 233441 Feb 20 18:52 ca-certificates.crt lrwxrwxrwx 1 1000 root 49 Feb 20 18:52 ca-cert-my-custom-ca.pem -> /usr/local/share/ca-certificates/my-custom-ca.crt lrwxrwxrwx 1 1000 root 24 Feb 20 18:52 51252b35.0 -> ca-cert-my-custom-ca.pem
Yet this does not seem to work completely.
Sure, I can confirm the certificate is trusted by OpenSSL:
$ openssl s_client -connect <my-server-crt-cn>:443 -showcerts CONNECTED(00000003) depth=1 C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-ca-name> verify return:1 depth=0 C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-server-crt-cn> verify return:1 --- Certificate chain 0 s:C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-server-crt-cn> i:C = FR, ST = France, L = Paris, O = x, OU = y, CN = <my-ca-name> ... Start Time: 1613847660 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no
Yet, other tools such as wget, or the ruby app I'm trying to run, do not seem to care:
$ wget https://<my-server-crt-cn>/ ssl_client: <my-server-crt-cn>: certificate verification failed: self signed certificate in certificate chain wget: error getting response: Connection reset by peer $ wget --no-check-certificate https://<my-server-crt-cn> -O- Connecting to <my-server-crt-cn> (10.42.253.168:443) writing to stdout <response> <returncode>SUCCESS</returncode> <version>2.0</version>
I can reproduce building the following image:
FROM docker.io/alpine:3.11 RUN apk add --no-cache \ ca-certificates \ openssl COPY my-ca.crt /usr/local/share/ca-certificates
Testing on my workstation (Debian), I have no troubles at all, once the CA is trusted I can use wget/curl without ignoring tls errors.
Did I do something wrong? Why would wget or ruby keep complaining about my certificate being self-signed?