dotnet / dotnet/aspnetcore

SSL works in Ubuntu Docker container on desktop, but fails in Docker on Ubuntu Server

Open
#53,468 8 comments 0 reactions 0 assignees View on GitHub
area-networking untriaged
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Description

started with a configuration using nginx proxy serving multiple web sites.
1) first problem occurred when trying to deploy a website with .net Identity using the external MicrosoftAccounts provider.
- no problems making this work on local host but it fails when deployed to the web server.
- Initially I thought his was a proxy forwarding problem
- but it turns out SSL is required between the webserver and proxy.
- Is this a bug? Seems unintuitive and I found no reference to it in any of the documentation. The generated error is also misleading. It complains that redirect_uri doesn't match.
- The only reason they don't match is because the underlying transport is not SSL and something in the Identity handshake notices.
- Ideally I'd like to be able to use Identity without SSL since my proxy server guarantees SSL externally.

2) Second problem occurred when trying to use SSL with the docker container.
- SSL in a docker container on the dev machine, with the dev certificate works fine.
- Production SSL certificates from letsencrypt work fine on the dev machine also.
- But they failed with docker on the Ubuntu server. (even without the proxy).
- Documentation was not clear on how this should be configured. Server just refuses connection.
- After much trial and error, I discovered that if you specify the cert.pem and privkey.pem in the appsettings.json then it works. This should be documented in the walkthroughs.

```json
"Kestrel": {
"EndPoints": {
"Http": {
"Url": "http://0.0.0.0"
},
"HttpsFromPem": {
"Url": "https://0.0.0.0:443",
"Certificate": {
"Path": "/etc/letsencrypt/live/apointlesswasteoftime.com/fullchain.pem",
"KeyPath": "/etc/letsencrypt/live/apointlesswasteoftime.com/privkey.pem"
}
}
}
}
```

### Reproduction Steps

- create a razor web project.
- Get production certificates from letsencrypt
- setup locally with production certificates in a docker container. Note that it works.
- Delploy the docker container to a ubuntu server. Note that it doesn't work unless you use the specific configuration setting in the appsettings.json. I could not get this to work by configuring the certs in the programs.cs

### Expected behavior

expect that the behavior between the ubuntu docker container on the dev machine should be identical the behavior on the ubuntu server.
This is a bug. I suspect it is due to some ASP.NET interactions with the networking stack?

### Actual behavior

Works fine in Ubuntu container on desktop.
I can even point the nginx proxy at the desktop container and it works fine.
Just didn't work on server without specifying the certs in the appsettings.json.

### Regression?

don't know.

### Known Workarounds

specifying the certs in the appsettings.json rather than in programs.cs

### Configuration

.Net 8 & 7 both appear to repro this.
Latest Ubuntu and Docker
all systems are x64

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.