influxdata / influxdata/influxdata-docker
Using a Let's Encrypt SSL certificate with the Alpine image
- Dominant language
- Shell
- Stars
- 364
- Forks
- 255
- Avg merge
- 3h 18m
- Merged PRs (30d)
- 7
Description
I have a problem that's been quite hard to debug. Trying to use a Let's Encrypt certificate, I'm unable to have it play nice with `influxdb:alpine`. The certificate is issued for `*.ourdomain.com` and everything seems to be in order:
```
Data:
Version: 3 (0x2)
Serial Number:
XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:6f:XX:XX:XX:XX:XX:XX:XX
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
Validity
Not Before: Dec 6 16:32:07 2018 GMT
Not After : Mar 6 16:32:07 2019 GMT
Subject: CN = *.ourdomain.com
```
I have loaded a similar certificate on our `chronograf:alpine` image without a problem. The error I am getting from my client:
```
$ influx -ssl -host ts.ourdomain.com
$ Failed to connect to https://ts.ourdomain.com:8086: Get https://ts.ourdomain.com:8086/ping: x509: certificate signed by unknown authority
Please check your connection settings and ensure 'influxd' is running.
```
The error that I am getting from my docker container:
```
2018/12/07 13:19:03 http: TLS handshake error from 79.173.555.555:40786: remote error: tls: bad certificate
```
Any idea where that could come from or how to debug further? Thanks
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the TLS connection against the influxdb:alpine container using the reported influx client command, then compare its certificate setup with the working chronograf:alpine setup. Inspect the container's TLS configuration and certificate chain; done means the source of the unknown-authority and bad-certificate errors is identified and a reproducible configuration fix is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100