1

I have a SQL Server 2019 container that I'm trying to set up with an SSL certificate, following the steps outlined here. But when I go to run the container with docker run, it does a bit of spinning up, then errors out:

Unable to initialize user-specified certificate configuration. The server is being shut down. Verify that the certificate is correctly configured.

The container abruptly terminates at this point. So I try connecting to a shell to debug, by spinning up the container with the -d flag and then connecting with docker exec -it [name] "bash". But I only have a few moments to poke around inside the container, because apparently the process described above is still going on, and it quickly errors, shuts down, and pulls the container out from under me.

The base container I'm deriving this work from is mcr.microsoft.com/mssql/server:2019-latest. Is there any way to get an unlimited amount of time to debug this certificate issue?

5
  • Does your docker run command work without any of the file mount parameters for the certificate and configuration? Possibly the SQL Instance is shutting down for other reasons, such as an sa password that doesn't meet complexity requirements. May 12, 2021 at 2:18
  • @AlwaysLearning There aren't any parameters like that in the docker run command. That's all in the server configuration. May 12, 2021 at 3:06
  • So, in your Dockerfile then? May 12, 2021 at 3:15
  • Yah, in the mssql.conf file that the Dockerfile copies into the container. That part's not the problem. The problem is that I don't have a way to get a shell that doesn't get pulled out from under me. May 12, 2021 at 3:23
  • 1
    The shell's getting pulled out from under you because SQL Server isn't starting successfully. So remove customizations until it does start successfully, then start scrutinizing the customizations until you figure out what's broken. May 12, 2021 at 9:56

1 Answer 1

1

Start by looking at the container logs. For example, if your database container is called sql2019 then from the host you might issue something similar to:

# docker logs sql2019
...
2021-05-12 13:09:14.47 spid26s     Error: 49940, Severity: 16, State: 1.
2021-05-12 13:09:14.47 spid26s     Unable to open one or more of the user-specified certificate file(s). Verify that the certificate file(s) exist with read permissions for the user and group running SQL Server.
2021-05-12 13:09:14.56 spid26s     Error: 49939, Severity: 16, State: 1.
2021-05-12 13:09:14.56 spid26s     Unable to initialize user-specified certificate configuration. The server is being shut down. Verify that the certificate is correctly configured. Error[30]. State[51].
...
db exited with code 1
db   | SQL Server 2019 will run as non-root by default.
db   | This container is running as user mssql.
db   | Your master database file is owned by mssql.
db   | To learn more visit https://go.microsoft.com/fwlink/?linkid=2099216.

This tells us some important information:

  • We know the file paths are correct because we put them there in the Dockerfile and the mssql.conf file.
  • We know permissions could be a problem because they're mentioned in the error message.
  • We know that the SQL Server service is running with user mssql so we permissions need to allow for that.

In your Dockerfile you probably have lines similar to the following:

COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
COPY ./mssql.conf /var/opt/mssql/mssql.conf

Temporarily comment out the mssql.conf line and docker up again (without the configuration file):

COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
# COPY ./mssql.conf /var/opt/mssql/mssql.conf

With the container running you can get a CLI to check the permissions in the /etc/ssl folder...

# ls -la /etc/ssl
total 32
drwxr-xr-x 1 root root  4096 Apr  3 03:26 .
drwxr-xr-x 1 root root  4096 May 12 13:34 ..
drwxr-xr-x 1 root root  4096 May 12 13:34 certs
-rw-r--r-- 1 root root 10909 Mar 22 11:37 openssl.cnf
drwx------ 1 root root  4096 May 12 13:34 private

Note that the /etc/ssl/private folder is owned by the root user and only accessible by the root user. These permissions will prevent the mssql user reading the /etc/ssl/private/mssql.key file.

Update your Dockerfile to make the /etc/ssl/private folder accessible:

COPY ./mssql.pem /etc/ssl/certs/mssql.pem
COPY ./mssql.key /etc/ssl/private/mssql.key
COPY ./mssql.conf /var/opt/mssql/mssql.conf
USER root
RUN chmod 755 /etc/ssl/private
USER mssql

And now when you docker up the SQL Server container should start successfully.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.