Error: http: TLS handshake error from 127.0.0.1:59026: remote error: tls: bad certificate #970

cgHome · 2022-07-04T14:49:27Z

cgHome
Jul 4, 2022

Hi,

Actually, I (as a ca-newbie) just wanted to extend my (Docker) Homelab server on my QNAP, with a Traefik and step-ca container. The configuration was principle simple, but instead of a valid step-ca certificate I received a "TRAEFIK DEFAULT CERT" certificate.

On closer analysis I noticed that on the command: "curl -k https://localhost:9000/acme/admin/directory" the following error message:

bash-5.1$ curl -k https://localhost:9000/health
{"status":"ok"}
bash-5.1$ curl -k https://localhost:9000/acme/local/directory
{"type":"urn:ietf:params:acme:error:accountDoesNotExist","detail":"Account does not exist"}

To narrow it down, I focused on the step-ca container and ran into the following problem.

When I start the test.yml file, everything is initialized and started correctly according to the log file. Also from the command "step ca health" in the (step-ca) container I get the message OK.

So far so good, but when I execute the command: "step certificate inspect https://localhost:9000" I get the following error message:

(step-ca container)

bash-5.1$ step version
Smallstep CLI/0.19.0 (linux/amd64)
Release Date: 2022-04-19 23:09 UTC
bash-5.1$ step ca health
ok
bash-5.1$ step certificate inspect https://localhost:9000
x509: certificate signed by unknown authority
failed to connect
github.com/smallstep/cli/command/certificate.getPeerCertificates
        /src/command/certificate/remote.go:57
github.com/smallstep/cli/command/certificate.inspectAction
        /src/command/certificate/inspect.go:217
github.com/urfave/cli.HandleAction
        /go/pkg/mod/github.com/urfave/[email protected]/app.go:522
github.com/urfave/cli.Command.Run
        /go/pkg/mod/github.com/urfave/[email protected]/command.go:173
github.com/urfave/cli.(*App).RunAsSubcommand
        /go/pkg/mod/github.com/urfave/[email protected]/app.go:405
github.com/urfave/cli.Command.startApp
        /go/pkg/mod/github.com/urfave/[email protected]/command.go:372
github.com/urfave/cli.Command.Run
        /go/pkg/mod/github.com/urfave/[email protected]/command.go:102
github.com/urfave/cli.(*App).Run
        /go/pkg/mod/github.com/urfave/[email protected]/app.go:277
main.main
        /src/cmd/step/main.go:102
runtime.main
        /usr/local/go/src/runtime/proc.go:250
runtime.goexit
        /usr/local/go/src/runtime/asm_amd64.s:1571

step-ca    | 2022/07/04 14:05:40 /usr/local/go/src/net/http/server.go:3195: http: TLS handshake error from 127.0.0.1:59026: remote error: tls: bad certificate

Am I doing something wrong or is this a problem with the step-ca server ?

Chris

test.yml

networks:
  default:

services:
  step-ca:
    container_name: step-ca
    image: smallstep/step-ca:latest
    restart: unless-stopped
    environment:
      STEPDEBUG: 1
      DOCKER_STEPCA_INIT_NAME: LocalCA
      DOCKER_STEPCA_INIT_DNS_NAMES: localhost,127.0.0.1,step-ca,ca.zeus.lan
      DOCKER_STEPCA_INIT_PROVISIONER_NAME: local
      DOCKER_STEPCA_INIT_SSH: "yes"
    ports:
      - 9000:9000
    volumes:
      - step-ca:/home/step

volumes:
  step-ca:
    name: step-ca

ca.json

{
	"root": "/home/step/certs/root_ca.crt",
	"federatedRoots": null,
	"crt": "/home/step/certs/intermediate_ca.crt",
	"key": "/home/step/secrets/intermediate_ca_key",
	"address": ":9000",
	"insecureAddress": "",
	"dnsNames": [
		"localhost",
		"127.0.0.1",
		"step-ca",
		"ca.zeus.lan"
	],
	"ssh": {
		"hostKey": "/home/step/secrets/ssh_host_ca_key",
		"userKey": "/home/step/secrets/ssh_user_ca_key"
	},
	"logger": {
		"format": "text"
	},
	"db": {
		"type": "badgerv2",
		"dataSource": "/home/step/db",
		"badgerFileLoadingMode": ""
	},
	"authority": {
		"provisioners": [
			{
				"type": "JWK",
				"name": "local",
				"key": {
					"use": "sig",
					"kty": "EC",
					"kid": "PJwCvN7dVO_WExiSLCnQgUswS56k91Vg8B__r0wigeU",
					"crv": "P-256",
					"alg": "ES256",
					"x": "Wof5WTADnBhgQC-T5-f3x_kJB1Ps2EDVquqVfR3TxK0",
					"y": "YbAve0-bw-rLy43yX2lpp060roKiDTxzvTtQUWG_fdE"
				},
				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiSzJCUXNyODFFc2JyREhRLVQ3ZmdzZyJ9.6s7wo79IAXSH6-N10G035766qZogSzuQvIdAiCzaSZzPE6htVFzC6Q.Rm-AnK8EL318ALho.tYw9YA05gb1GjfveFBw8ReI06du3njStlVR1FA_hagCRrmjYJCW5HxSuk_6y0l6qq3FJDtSP5JuaB-j6T1dd1jNQKl9dOE6ff4gGQ8pUCI8xAtj2h1KYybMPQp7MnHa0gvRNqbdN1cbfdRlVQ4urCERlKyI6h7EbQWPsaMiIHcCp29aMJ-5pjveK62rR8cv0vA70GskwYZcx8bVxIiougOuRfPSuPz21Wn2YGIGStJStX5sOpVB9FeS20dhJ6Nnncsenjo8Dr09chXlSlvIKJu67tEDVsZvx3peyRb_t17onRRvdkP1qVYymCSkRQvWM0ocBnGVqQ8aROt85r2w.uHV0Bxv9_BO2ReIX_-kuDw",
				"claims": {
					"enableSSHCA": true
				}
			},
			{
				"type": "SSHPOP",
				"name": "sshpop",
				"claims": {
					"enableSSHCA": true
				}
			}
		]
	},
	"tls": {
		"cipherSuites": [
			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
		],
		"minVersion": 1.2,
		"maxVersion": 1.3,
		"renegotiation": false
	},
	"templates": {
		"ssh": {
			"user": [
				{
					"name": "config.tpl",
					"type": "snippet",
					"template": "templates/ssh/config.tpl",
					"path": "~/.ssh/config",
					"comment": "#"
				},
				{
					"name": "step_includes.tpl",
					"type": "prepend-line",
					"template": "templates/ssh/step_includes.tpl",
					"path": "${STEPPATH}/ssh/includes",
					"comment": "#"
				},
				{
					"name": "step_config.tpl",
					"type": "file",
					"template": "templates/ssh/step_config.tpl",
					"path": "ssh/config",
					"comment": "#"
				},
				{
					"name": "known_hosts.tpl",
					"type": "file",
					"template": "templates/ssh/known_hosts.tpl",
					"path": "ssh/known_hosts",
					"comment": "#"
				}
			],
			"host": [
				{
					"name": "sshd_config.tpl",
					"type": "snippet",
					"template": "templates/ssh/sshd_config.tpl",
					"path": "/etc/ssh/sshd_config",
					"comment": "#",
					"requires": [
						"Certificate",
						"Key"
					]
				},
				{
					"name": "ca.tpl",
					"type": "snippet",
					"template": "templates/ssh/ca.tpl",
					"path": "/etc/ssh/ca.pub",
					"comment": "#"
				}
			]
		}
	}
}

Log-File

[/share/Container/data/home.server/0-core] # docker-compose -f test.yml up                      
Creating network "0-core_default" with the default driver
Creating volume "step-ca" with default driver
Creating step-ca ... done
Attaching to step-ca
step-ca    | 
step-ca    | Generating root certificate... done!
step-ca    | Generating intermediate certificate... done!
step-ca    | Generating user and host SSH certificate signing keys... done!
step-ca    | 
step-ca    | ✔ Root certificate: /home/step/certs/root_ca.crt
step-ca    | ✔ Root private key: /home/step/secrets/root_ca_key
step-ca    | ✔ Root fingerprint: 28bc3b6d5925d3c35e4a4bbceb976f921474648abbbbf87920310cecde37fdb4
step-ca    | ✔ Intermediate certificate: /home/step/certs/intermediate_ca.crt
step-ca    | ✔ Intermediate private key: /home/step/secrets/intermediate_ca_key
step-ca    | ✔ SSH user public key: /home/step/certs/ssh_user_ca_key.pub
step-ca    | ✔ SSH user private key: /home/step/secrets/ssh_user_ca_key
step-ca    | ✔ SSH host public key: /home/step/certs/ssh_host_ca_key.pub
step-ca    | ✔ SSH host private key: /home/step/secrets/ssh_host_ca_key
step-ca    | ✔ Database folder: /home/step/db
step-ca    | ✔ Templates folder: /home/step/templates
step-ca    | ✔ Default configuration: /home/step/config/defaults.json
step-ca    | ✔ Certificate Authority configuration: /home/step/config/ca.json
step-ca    | 
step-ca    | Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.
step-ca    | 
step-ca    | FEEDBACK 😍 🍻
step-ca    |   The step utility is not instrumented for usage statistics. It does not phone
step-ca    |   home. But your feedback is extremely valuable. Any information you can provide
step-ca    |   regarding how you’re using `step` helps. Please send us a sentence or two,
step-ca    |   good or bad at [email protected] or join GitHub Discussions
step-ca    |   https://github.com/smallstep/certificates/discussions and our Discord 
step-ca    |   https://u.step.sm/discord.
step-ca    | badger 2022/07/04 14:03:54 INFO: All 0 tables opened in 0s
step-ca    | 2022/07/04 14:03:55 Starting Smallstep CA/0.20.0 (linux/amd64)
step-ca    | 2022/07/04 14:03:55 Documentation: https://u.step.sm/docs/ca
step-ca    | 2022/07/04 14:03:55 Community Discord: https://u.step.sm/discord
step-ca    | 2022/07/04 14:03:55 Config file: /home/step/config/ca.json
step-ca    | 2022/07/04 14:03:55 The primary server URL is https://localhost:9000
step-ca    | 2022/07/04 14:03:55 Root certificates are available at https://localhost:9000/roots.pem
step-ca    | 2022/07/04 14:03:55 Additional configured hostnames: 127.0.0.1, step-ca, ca.zeus.lan
step-ca    | 2022/07/04 14:03:55 X.509 Root Fingerprint: 28bc3b6d5925d3c35e4a4bbceb976f921474648abbbbf87920310cecde37fdb4
step-ca    | 2022/07/04 14:03:55 SSH Host CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO5PqVFZN4lhM53THq9ZDq+dWsbQRQAKO0X9F5EPjYKZDc7G5+uU9gP2ruGKZgAzlJVtEWovFdTjHRzAGoZW6y0=
step-ca    | 
step-ca    | 2022/07/04 14:03:55 SSH User CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDQveR2T93qP7U4hbKCvlxIHuyUUBw58KXrj4sZ9HKIfRR0pQGKxvKvg99I7svkbWNdX2SvyZkx5oEHT4cFg+ww=
step-ca    | 
step-ca    | 2022/07/04 14:03:55 Serving HTTPS on :9000 ....

hslatman · 2022-07-05T09:18:03Z

hslatman
Jul 5, 2022
Collaborator

Hi @cgHome,

The step certificate inspect command isn't "CA-aware", meaning that it doesn't implicitly trust the root CA of your step-ca instance. The step ca health command is in fact "CA-aware", and trusts your private root (if bootstrapped to trust it before). Both commands reach out to the CA server by an HTTPS request, but using different trust anchors. This results in the x509: certificate signed by unknown authority error when using step certificate request, since it uses the system default trust store, which doesn't include your private CA (by default). You can pass --roots /path/to/root_ca.crt to step certificate inspect to make the command work. Alternatively, you can install your private root CA in the system trust store; be sure to adequately protect the private key.

The other thing I noticed is that you seem to be trying to use ACME? Currently our Docker image does not create an ACME provisioner at startup by default. The provisioner that is created and named after the DOCKER_STEPCA_INIT_PROVISIONER_NAME: local configuration, is a JWK provisioner. The JWK provisioner is a very versatile and powerful provisioner, but doesn't provide you with ACME capabilities. You'll need to configure a separate ACME provisioner after the CA has been started. You can do so by altering the ca.json manually or using the step ca provisioner command.

1 reply

cgHome Aug 6, 2022
Author

Thanks !!! Sorry for the delay, but I had "offline" vacations.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error: http: TLS handshake error from 127.0.0.1:59026: remote error: tls: bad certificate #970

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 1 reply

{{title}}

{{title}}

Select a reply

Error: http: TLS handshake error from 127.0.0.1:59026: remote error: tls: bad certificate #970

cgHome Jul 4, 2022

Replies: 1 comment · 1 reply

hslatman Jul 5, 2022 Collaborator

cgHome Aug 6, 2022 Author

cgHome
Jul 4, 2022

Replies: 1 comment 1 reply

hslatman
Jul 5, 2022
Collaborator

cgHome Aug 6, 2022
Author