x509: certificate signed by unknown authority

[alexmc1510]

Bug description
When I configure a template repositoty using my enterprise github repository I get an error saying: x509: certificate signed by unknown authority

Expected behavior
I should be able to see my catalogue.

Portainer Logs
Provide the logs of your Portainer container or Service.
You can see how here

docker container logs 67122dc88254
2023/06/13 07:53AM INF github.com/portainer/portainer/api/cmd/portainer/main.go:494 > encryption key file not present | filename=portainer
2023/06/13 07:53AM INF github.com/portainer/portainer/api/cmd/portainer/main.go:517 > proceeding without encryption key |
2023/06/13 07:53AM INF github.com/portainer/portainer/api/database/boltdb/db.go:124 > loading PortainerDB | filename=portainer.db
2023/06/13 07:53:49 server: Reverse tunnelling enabled
2023/06/13 07:53:49 server: Fingerprint 44:fe:3b:47:fd:b8:0a:f5:70:7a:1c:f8:38:dd:a9:5d
2023/06/13 07:53:49 server: Listening on 0.0.0.0:8000...
2023/06/13 07:53AM INF github.com/portainer/portainer/api/cmd/portainer/main.go:765 > starting Portainer | build_number=30140 go_version=1.19.4 image_tag=linux-amd64-2.18.2 nodejs_version=18.16.0 version=2.18.2 webpack_version=5.68.0 yarn_version=1.22.19
2023/06/13 07:53AM INF github.com/portainer/portainer/api/http/server.go:342 > starting HTTPS server | bind_address=:9443
2023/06/13 07:53AM INF github.com/portainer/portainer/api/http/server.go:327 > starting HTTP server | bind_address=:9000
{"time":1686828603,"message":"http: response.WriteHeader on hijacked connection from github.com/portainer/libhttp/error.writeErrorResponse (error.go:37)"}
{"time":1686828603,"message":"http: response.Write on hijacked connection from encoding/json.(*Encoder).Encode (stream.go:231)"}

Steps to reproduce the issue:

1. Go to 'Settings - App Templates'
2. Fill the gap with my enterprise GitHub URL 'https://github.xxxxx.corp/raw/xxxxx/AppCatalogue/main/templates.json'
3. Click on 'Save application Settings'
4. Goto App Templates - Custom templates
5. See error

Technical details:

• Portainer version: Community Edition 2.18.2
• Docker version (managed by Portainer): 20.10.16
• Kubernetes version (managed by Portainer): N/A
• Platform (windows/linux): RHEL
• Command used to start Portainer (docker run -p 9443:9443 portainer/portainer): docker run -p 9443:9443 portainer/portainer-ce:latest
• Browser: Chrome
• Use Case (delete as appropriate): Using Portainer at Home, Using Portainer in a Commercial setup: Using portainer in a LAB
• Have you reviewed our technical documentation and knowledge base? Yes

Additional context
Add any other context about the problem here.

[jamescarppe]

Please complete the rest of the fields in the bug template - this helps us to get a better picture of the issue you're experiencing so we can attempt to help.

[alexmc1510]

Hello, everything is updated accordingly.

[alexmc1510]

Hello,
My feeling is that the ca-certificate is missing in Portainer container and that is the reason why I get this error. The thing is that Portainer does not have sh access so I cannot debug o check the FS. Do you have any idea on how to ingest it? The flag that appears in the guide --sslcacert does not work.

[pasger]

I have exactly the same problem when I try to add my personal registry.

I started the docker with: --sslcert /data/certs/cert.pem --sslkey /data/certs/key.pem --sslcacert /data/certs/CAs/ca.pem

Version: Portainer Business Edition 2.18.3

[MrBlackRain]

I have the same problem on Portaine Community Edition 2.18.3.
Also, I made my own little independent research, seems like "sslcacert" flag is just missing in the list of possible CLI flags. There are no related field in CLIFlags structure (file api/portainer.go) and no such string in Service.ParseFlags (file api/cli/cli.go). More interesting that CopySSLCACert function exists in FileService interface (file api/portainer.go) and it has an implementation (file api/filesystem/filesystem.go), but has exactly 0 callers.

[alexmc1510]

It is a really stupid situation. Just CA verification is missing but no way to configure it inside the container. I can understand that for community...it is a bug and we need to wait...but @pasger is paying enterprise so...I don't see any benefit of paying for it.

[jamescarppe]

At present our app templates functionality doesn't support self-signed certs or custom CAs. I've flagged this with the team to be looked at in a future release.

[MrBlackRain]

Yeah, but it's clearly said in the documentation:

If you are using certificates signed by your own CA, you may need to supply your CA certificate as well with the --sslcacert flag.

This statement from the official documentation heavily implies that it is supported. Kinda confusing...

[jamescarppe]

The article you linked is explicitly referring to the certificate used by the UI and API. Per the first paragraph:

By default, Portainer’s web interface and API is exposed over HTTPS with a self-signed certificate generated by the installation. This can be replaced with your own SSL certificate either after installation via the Portainer UI or during installation, as explained in this article.

I'll look at adding some additional clarification in there, though.

[CampinCarl]

Adding a workaround here for anyone that stumbles on this thread—I was trying to get the edge agent to trust my private PKI and I was getting this same error. The --sslcacert flag didn't work for me (it's deprecated?), and neither did the --mtlscacert flag. What did work was replacing the /etc/ssl/certs/ca-certificates.crt file inside the container; my edge agent deployment came right up with this workaround.

I personally used a Docker Swarm secret to accomplish this but you could also just use a volume to mount your own file in place of the container's version of the file.

Hope this helps.