17

I have a Ubuntu 18.04 server behind a coporate proxy.

I set the http_proxy and https_proxy environment variable.

The server is running Docker 19.03 which is also configured to use the http_proxy and https_poxy.

If a run docker run -it ubuntu:18.04, inside the container, I can do an apt updateand apt install curl -y

Then I can do something like curl www.google.com.

But it is not working with https :

root@1b6abfb4ff90:/# curl -v -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     
0*   Trying 10.30.88.14...
* TCP_NODELAY set
* Connected to xxx (10.30.88.14) port 8080 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to raw.githubusercontent.com:443
> CONNECT raw.githubusercontent.com:443 HTTP/1.1
> Host: raw.githubusercontent.com:443
> User-Agent: curl/7.58.0
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 Connected
< 
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* CONNECT phase completed!
* CONNECT phase completed!
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [91 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2741 bytes data]
* TLSv1.2 (OUT), TLS alert, Server hello (2):
} [2 bytes data]
* SSL certificate problem: unable to get local issuer certificate
* stopped the pause stream!
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

Outside of the container, it's working fine. I also tried exactly the same on another server that is not behind a proxy and it's working inside the container.

So I suppose it is a configuration problem of the docker deamon. Or maybe I'm wrong ... What would be the solution ?

4
  • did you try to install apt-get install ca-certificates?
    – Adiii
    Oct 11, 2019 at 9:40
  • Yes it is up-to-date. It is installed with curl.
    – tweetysat
    Oct 11, 2019 at 9:42
  • Could you provide output of curl -v -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar, please? Check also if CA certificate of cert issuer available in the container.
    – Jan Garaj
    Oct 11, 2019 at 21:11
  • I updated the question. How can I check if CA certificate of cert issuer available in the container ?
    – tweetysat
    Oct 14, 2019 at 9:24

5 Answers 5

12

You need to install SSL certificates into the Ubuntu container. For example, on a running instance, you can do:

apt-get update
apt-get install ca-certificates

Then, all your HTTPs connections can be validated with the local copy of CA Root Certificates.

For production deployments, this command should be in a Dockerfile:

RUN \
  apt-get update && \
  apt-get install ca-certificates && \
  apt-get clean

Edit

It's possible that your proxy has an untrusted certificate. You can add it to the bundle, or tell curl not to check proxy's certificate with curl --proxy-insecure.

From https://curl.se/docs/sslcerts.html :

Since version 7.52.0, curl can do HTTPS to the proxy separately from the connection to the server. This TLS connection is handled separately from the server connection so instead of --insecure and --cacert to control the certificate verification, you use --proxy-insecure and --proxy-cacert. With these options, you make sure that the TLS connection and the trust of the proxy can be kept totally separate from the TLS connection to the server.

0
6

Download the latest cacert.pem from https://curl.haxx.se/ca/cacert.pem , better way will be add a step in the dockerfile to install the certificate as part of the build step.

Follow the steps to install

  1. Download the file from https://curl.haxx.se/ca/cacert.pem
  2. Rename the file as cacert.crt
  3. Copy the file to Go to /usr/local/share/ca-certificates/
  4. Run the command sudo update-ca-certificates
1
  • Where do I put it ? In /etc/ssl/certs/ca-certificates.crt ? If yes, nothing changed.
    – tweetysat
    Oct 14, 2019 at 9:45
2

don't mount the /etc/:/etc/ to docker container. the /etc/ in the host doesn't work for the docker container. let docker container uses its own /etc/.

1
  • this solved my problem! Mounting /tmp worked. Strangely, mounting the same etc volume via docker run command was working but kept getting tls: failed to verify certificate: x509 when tried to run it via docker compose Apr 4 at 16:39
0

You can hit this issue if you are attempting to connect via a machine which has an SSL intercepting certificate, or sometimes with virus scanners who try and be helpful.

You might need to add the certificate see this question How to add trusted root CA to Docker alpine

my steps to fix in case it helps anyone were to:

  • download the ROOT corporate certificate by going via the lock icon in chrome and exporting the cert. make sure you select the root of the chain to export
  • docker cp corp-cert.crt /usr/local/share/ca-certificates/
  • update-ca-certificates inside the container
0

In my case the problem was ZScaler was MITM-ing bt replacing Docker cert with the its root cert. Solution was - https://github.com/docker/for-win/issues/13671

1
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – TAbdiukov
    Sep 16 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.