添加context7 mcp 提示tls不受信任，容器内的 CA 证书存储缺少 Amazon Trust Services 的根证书 || Add context7 mcp prompts that tls is not trusted, and the CA certificate store in the container lacks the root certificate of Amazon Trust Services

claude code分析结果
根因分析：容器内 CA 证书存储缺少 Amazon Trust Services 根证书

问题概述

根据 Matrix 消息日志 (debug-log/20260325-003433)，Context7 MCP 服务器配置到 Higress 网关后出现 TLS
证书验证失败:

TLS error: 268435563:SSL routines:OPENSSL_internal:BAD_ECC_CERT

根本原因

Higress 网关运行在容器中，容器基础镜像的 CA 证书存储不完整，缺少 Amazon Trust Services 的根证书。

具体分析如下:

1. 基础镜像的 CA 证书来源

查看 openclaw-base/Dockerfile (第 18-42 行):

FROM ${HIGRESS_REGISTRY}/higress/all-in-one:sha-d32debd

RUN if [ -n "${APT_MIRROR}" ]; then \
sed -i "s|archive.ubuntu.com|${APT_MIRROR}|g; s|security.ubuntu.com|${APT_MIRROR}|g" \
/etc/apt/sources.list 2>/dev/null || true; \
fi && \
apt-get update && apt-get install -y \
git python3 make g++ curl \
jq nginx gettext-base openssh-client ca-certificates procps tzdata \
&& rm -rf /var/lib/apt/lists/*

问题在于:
- higress/all-in-one 基础镜像基于 Ubuntu 22.04
- 虽然安装了 ca-certificates 包，但该包的版本可能较旧
- Amazon Trust Services 的 G2 根证书 (Amazon Root CA 1/2/3/4) 在较新的 CA 证书包中才包含

2. Context7 MCP 使用 Amazon ECC 证书

从日志中可以看到:
- Context7 MCP 服务域名：mcp.context7.com
- 该服务使用 Amazon CloudFront 作为 CDN
- Amazon CloudFront 使用 Amazon Trust Services 的 ECC 证书

当 Higress 网关尝试反向代理到 mcp.context7.com 时:
1. Higress 验证上游服务器的 TLS 证书
2. 证书链追溯至 Amazon Trust Services 根证书
3. 容器内 /etc/ssl/certs/ca-certificates.crt 缺少该根证书
4. 验证失败，返回 BAD_ECC_CERT 错误

5. 为什么无法通过外部配置修复

日志中尝试的多种方法都失败了:

┌───────────────────────┬──────┬─────────────────────────┐
│ 方法 │ 结果 │ 原因 │
├───────────────────────┼──────┼─────────────────────────┤
│ 修改 Higress 配置文件 │ ❌ │ 需要重启容器 │ │
├───────────────────────┼──────┼─────────────────────────┤
│ 添加 Amazon 根证书 │ ❌ │ Higress 使用容器内的 CA │
├───────────────────────┼──────┼─────────────────────────┤
│ EnvoyFilter 配置 │ ❌ │ kubectl 不可用 │
├───────────────────────┼──────┼─────────────────────────┤
│ MCP 服务器 TLS 配置 │ ❌ │ API 不支持该参数 │
└───────────────────────┴──────┴─────────────────────────┘

根本原因: 容器的 CA 证书是镜像构建时固定的，无法通过运行时 API 修改。

解决方案

方案 1: 更新基础镜像的 CA 证书包 (推荐)

在 openclaw-base/Dockerfile 中更新 CA 证书:

RUN apt-get update && apt-get install -y \
ca-certificates curl \
&& update-ca-certificates \
&& rm -rf /var/lib/apt/lists/*

或者手动添加 Amazon 根证书:

RUN apt-get update && apt-get install -y ca-certificates \
&& curl -o /usr/local/share/ca-certificates/amazon-root.crt
https://www.amazontrust.com/repository/AmazonRootCA1.pem \
&& update-ca-certificates \
&& rm -rf /var/lib/apt/lists/*

方案 2: 使用本地 Context7 MCP (当前临时方案)

日志中已经采用的方案:
npx -y @upstash/context7-mcp@latest --transport http --port 3377

方案 3: Higress 配置跳过 TLS 验证 (需要管理员权限)

日志中生成的 EnvoyFilter 配置 (/tmp/context7-tls-filter.yaml):
validation_context:
trust_chain_verification: ACCEPT_UNTRUSTED

总结

┌──────────┬──────────────────────────────────────────────────────────┐
│ 问题 │ 容器内 CA 证书存储缺少 Amazon Trust Services 根证书 │
├──────────┼──────────────────────────────────────────────────────────┤
│ 影响 │ Higress 网关无法验证 Context7 MCP 的 TLS 证书 │
├──────────┼──────────────────────────────────────────────────────────┤
│ 根本原因 │ higress/all-in-one 基础镜像的 ca-certificates 包版本过旧 │
├──────────┼──────────────────────────────────────────────────────────┤
│ 解决方向 │ 更新基础镜像的 CA 证书包或手动添加 Amazon 根证书 │
└──────────┴──────────────────────────────────────────────────────────┘

Sources:
- Matrix message logs: debug-log/20260325-003433/matrix-messages/*.jsonl
- OpenClaw base Dockerfile: openclaw-base/Dockerfile
- Manager Dockerfile: manager/Dockerfile
- Gateway API: manager/scripts/lib/gateway-api.sh

---
claude code analysis results
Root cause analysis: Amazon Trust Services root certificate missing from in-container CA certificate store

Problem overview

According to Matrix message log (debug-log/20260325-003433), TLS occurs after Context7 MCP server is configured to Higress gateway
Certificate verification failed:

TLS error: 268435563:SSL routines:OPENSSL_internal:BAD_ECC_CERT

root cause

The Higress gateway runs in a container, and the CA certificate store of the container base image is incomplete and lacks the root certificate of Amazon Trust Services.

The specific analysis is as follows:

1. Source of CA certificate of base image

Look at openclaw-base/Dockerfile (lines 18-42):

FROM ${HIGRESS_REGISTRY}/higress/all-in-one:sha-d32debd

RUN if [ -n "${APT_MIRROR}" ]; then \
sed -i "s|archive.ubuntu.com|${APT_MIRROR}|g; s|security.ubuntu.com|${APT_MIRROR}|g" \
/etc/apt/sources.list 2>/dev/null || true; \
fi && \
apt-get update && apt-get install -y \
git python3 make g++ curl \
jq nginx gettext-base openssh-client ca-certificates procps tzdata \
&& rm -rf /var/lib/apt/lists/*

The problem is:
- The higress/all-in-one base image is based on Ubuntu 22.04
- Although the ca-certificates package is installed, the package may be an older version
- Amazon Trust Services' G2 root certificate (Amazon Root CA 1/2/3/4) is only included in newer CA certificate packages

2. Context7 MCP uses Amazon ECC certificate

You can see from the log:
- Context7 MCP service domain name: mcp.context7.com
- The service uses Amazon CloudFront as the CDN
- Amazon CloudFront uses ECC certificates from Amazon Trust Services

When the Higress gateway attempts to reverse proxy to mcp.context7.com:
1. Higress verifies the TLS certificate of the upstream server
2. The certificate chain traces back to the Amazon Trust Services root certificate
3. The root certificate is missing from /etc/ssl/certs/ca-certificates.crt in the container
4. Verification fails and returns BAD_ECC_CERT error

5. Why it cannot be fixed through external configuration

Various methods tried in the log failed:

┌──────────────────────┬─────┬────────────────────────┐
│ Method │ Result │ Reason │
├───────────────────────┼──────┼─────────────────────────┤
│ Modify Higress configuration file │ ❌ │ Need to restart the container │ │
├───────────────────────┼──────┼─────────────────────────┤
│ Add the Amazon root certificate │ ❌ │ Higress uses the CA inside the container │
├───────────────────────┼──────┼─────────────────────────┤
│ EnvoyFilter configuration │ ❌ │ kubectl is not available │
├───────────────────────┼──────┼─────────────────────────┤
│ MCP Server TLS Configuration │ ❌ │ API does not support this parameter │
└──────────────────────┴──────┴─────────────────────────┘

Root cause: The container's CA certificate is fixed when the image is built and cannot be modified through the runtime API.

solution

Solution 1: Update the CA certificate package of the base image (recommended)

Update the CA certificate in openclaw-base/Dockerfile:

RUN apt-get update && apt-get install -y \
ca-certificates curl \
&& update-ca-certificates \
&& rm -rf /var/lib/apt/lists/*

Or add the Amazon root certificate manually:

RUN apt-get update && apt-get install -y ca-certificates \
&& curl -o /usr/local/share/ca-certificates/amazon-root.crt
https://www.amazontrust.com/repository/AmazonRootCA1.pem \
&& update-ca-certificates \
&& rm -rf /var/lib/apt/lists/*

Option 2: Use local Context7 MCP (current temporary solution)

Solutions already adopted in the log:
npx -y @upstash/context7-mcp@latest --transport http --port 3377

Scenario 3: Higress configuration to skip TLS verification (requires administrator privileges)

EnvoyFilter configuration generated in the log (/tmp/context7-tls-filter.yaml):
validation_context:
trust_chain_verification: ACCEPT_UNTRUSTED

Summary

┌───────────┬──────────────────────────────────────────────────────────┐
│ Problem │ In-container CA certificate store is missing Amazon Trust Services root certificate │
├───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────
│ Impact │ Higress gateway cannot verify TLS certificate for Context7 MCP │
├───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────
│ Root cause │ The ca-certificates package version of the higress/all-in-one base image is too old │
├───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────
│ Solution direction │ Update the CA certificate package of the base image or manually add the Amazon root certificate │
└───────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────

Sources:
- Matrix message logs: debug-log/20260325-003433/matrix-messages/*.jsonl
- OpenClaw base Dockerfile: openclaw-base/Dockerfile
- Manager Dockerfile: manager/Dockerfile
- Gateway API: manager/scripts/lib/gateway-api.sh