SSL works in Ubuntu Docker container on desktop, but fails in Docker on Ubuntu Server
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Description
started with a configuration using nginx proxy serving multiple web sites.
1) first problem occurred when trying to deploy a website with .net Identity using the external MicrosoftAccounts provider.
- no problems making this work on local host but it fails when deployed to the web server.
- Initially I thought his was a proxy forwarding problem
- but it turns out SSL is required between the webserver and proxy.
- Is this a bug? Seems unintuitive and I found no reference to it in any of the documentation. The generated error is also misleading. It complains that redirect_uri doesn't match.
- The only reason they don't match is because the underlying transport is not SSL and something in the Identity handshake notices.
- Ideally I'd like to be able to use Identity without SSL since my proxy server guarantees SSL externally.
2) Second problem occurred when trying to use SSL with the docker container.
- SSL in a docker container on the dev machine, with the dev certificate works fine.
- Production SSL certificates from letsencrypt work fine on the dev machine also.
- But they failed with docker on the Ubuntu server. (even without the proxy).
- Documentation was not clear on how this should be configured. Server just refuses connection.
- After much trial and error, I discovered that if you specify the cert.pem and privkey.pem in the appsettings.json then it works. This should be documented in the walkthroughs.
```json
"Kestrel": {
"EndPoints": {
"Http": {
"Url": "http://0.0.0.0"
},
"HttpsFromPem": {
"Url": "https://0.0.0.0:443",
"Certificate": {
"Path": "/etc/letsencrypt/live/apointlesswasteoftime.com/fullchain.pem",
"KeyPath": "/etc/letsencrypt/live/apointlesswasteoftime.com/privkey.pem"
}
}
}
}
```
### Reproduction Steps
- create a razor web project.
- Get production certificates from letsencrypt
- setup locally with production certificates in a docker container. Note that it works.
- Delploy the docker container to a ubuntu server. Note that it doesn't work unless you use the specific configuration setting in the appsettings.json. I could not get this to work by configuring the certs in the programs.cs
### Expected behavior
expect that the behavior between the ubuntu docker container on the dev machine should be identical the behavior on the ubuntu server.
This is a bug. I suspect it is due to some ASP.NET interactions with the networking stack?
### Actual behavior
Works fine in Ubuntu container on desktop.
I can even point the nginx proxy at the desktop container and it works fine.
Just didn't work on server without specifying the certs in the appsettings.json.
### Regression?
don't know.
### Known Workarounds
specifying the certs in the appsettings.json rather than in programs.cs
### Configuration
.Net 8 & 7 both appear to repro this.
Latest Ubuntu and Docker
all systems are x64
### Other information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.