60 SSL certificate problem: unable to get local issuer certificate

Zottelchen · 2021-07-27T01:28:19.794Z

Are you using stock Docker compose setup? Yes (but this also happens on the demo instance)

Describe the problem you’re having:
When trying to add a feed tt-rss can’t load it and shows the error: 60 SSL certificate problem: unable to get local issuer certificate

Include steps to reproduce the problem:

Try to add Bdsmlr RSS Feed safeblogfordemopurposes

tt-rss version (including git commit id): v21.04-e8f78181f

Platform (i.e. Linux distro, PHP, PostgreSQL, etc) versions:

Docker on Ubuntu 20.04: PHP Version 8.0.2 / alpine 3.13

Please provide any additional information below:

I know that the SSL certificate is fucked for some reason. For a python script I had to download the certificate chain and had to specify it into my script. Is something like this possible with tt-rss or the docker container?

pahles · 2021-07-27T08:12:07.999Z

The problem is the certificate chain, see SSL Checker.

Fix the certificate/chain!

fox · 2021-07-27T08:45:33.037Z

tt-rss (well, php / curl) uses system certificate store, in case of docker the base is alpine linux. you need to figure out where to place downloaded certificate file so its added to the trusted store and it should work from then on, i think.

github.com/gliderlabs/docker-alpine

How to add CA root certification (self-signed)

opened 04:26AM - 06 Mar 17 UTC

closed 05:33PM - 05 May 17 UTC

spoon99

question

I have self-signed CA root certification, and I try to add this to my custom alp…ine docker. ``` FROM alpine:3.4 # Install Self-signed Root CA ADD cert/* /tmp/cert/ RUN apk add --no-cache ca-certificates && \ mkdir /usr/share/ca-certificates/extra && \ cp -R /tmp/cert/* /usr/share/ca-certificates/extra/ && \ update-ca-certificates ``` After building container, I try to find out my certification installed properly with following comand. but I couldn't found my certification. ``` cat /etc/sslca-certificates.crt | grep CwYDVR0PBAQDAgIEMA0GCSqGSIb3DQEBDQUAA4IBAQAfcevn . (part of my cert) ``` Should I edit /etc/ca-certificates.conf file before update-ca-certifcates?

unless something changed from 2017, it seems that you’ll need to

place the file into /usr/local/share/ca-certificates
run update-ca-certificates on container build or startup, depending on when you want to inject your file - on build stage or afterwards

that however would mean using custom image so you won’t be able to use prebuilt images from docker hub.

i could update the images to run the command on startup, so you’d be able to mount your certificate files via yml and it would just work, but i’d like to know if the above still works before i start screwing around with it.

Zottelchen · 2021-07-27T16:43:53.475Z

Hey, thanks for the info! I’ve added the following three lines to the app/Dockerfile:

RUN apk add --no-cache --update ca-certificates
ADD *.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates

The wildcard is there because the chain file had to be split - each file may only contain a single certificate, so for my case it is 3 files. Then I’ve rebuilt app & updater using:

docker-compose up -d --no-deps --build app
docker-compose up -d --no-deps --build updater

That seems to work! Thank you!

Zottelchen · 2021-07-27T16:45:23.228Z

Sadly, it isn’t my server configuration that’s screwed up. I sent them a ticket and opened an issue on their GitHub, but they are not very communicative, so who knows if or when it will be fixed.

fox · 2021-07-27T16:51:22.082Z

i suppose adding update-ca-certificates to startup script would work, and then you’ll just do

volumes:
    ./ca1.crt://usr/local/share/ca-certificates/c1.crt:ro

etc, so that it would work with hub image

Zottelchen · 2021-07-29T02:03:38.609Z

An official way would be appreciated, but this ‘hack’ also works, so no rush

fox · 2021-08-23T07:17:49.777Z

sorry for the delay.

https://git.tt-rss.org/fox/ttrss-docker-compose/commit/5f3a1bcc7586327fb519da96ef71dc0bf9d80960

https://git.tt-rss.org/fox/ttrss-docker-compose/commit/3c30e416063c5ac77da27206d7e24d208962e6a3

https://git.tt-rss.org/fox/ttrss-docker-compose/wiki/Home#how-do-i-use-custom-certificates

helious · 2021-09-14T17:22:41.423Z

I came same problem recently. Differently, I can connect the service via Edge or Chrome Browser. But can’t connect it on Andriod Tiny-Tiny RSS APP.
With the intuition of pahles’s answer, I solved it.

pahles:

The problem is the certificate chain, see SSL Checker .

I am using docker-compose to start rss service which run behind nginx reverse proxy, And my certificate was issued by Let’s Encrypt.
After the issue the certificate，I got four files which includes( ca.cer, fullchain.cer, server_name.cer, private key).
on my nginx configuration:
Before, I configure ssl_certificate /path/to/my/server_name.cer, with curl the service for test. It warns me the same as yours
Then, I configure ssl_certificate /path/to/my/fullchain.cer, then restart nginx.
It works like a magic.
Hope it helps.

pahles · 2021-09-14T19:38:49.624Z

I have no idea what you’re babbling about, this has nothing to do with the problem here at hand.

helious · 2021-09-15T15:59:13.986Z

Sorry for my poor English. What I want to express is that your answer about this problem is the certificate chain problem helps me，it makes me realise that I should use fullchain certificate instead of server_name certificate only. And after i changed, it works.
Sorry for troubling you.

Scaner · 2021-10-01T10:19:49.627Z

Today I’ve got the same problem with many feeds at different sites.

How I can set to ignore the problem with ssl?

fox · 2021-10-01T10:38:41.113Z

Scaner:

How I can set to ignore the problem with ssl?

please MITM yourself on a different website, thanks. around here we respect basic security.

fox · 2021-10-02T06:20:50.545Z

A post was merged into an existing topic: 60 SSL certificate problem certificate has expired

fox · 2021-10-01T10:56:11.034Z

yeah, definitely this.

Scaner · 2021-10-01T11:07:19.012Z

I wish you not to get help when you will ask it too

Scaner · 2021-10-01T11:08:51.832Z

I know it, but browser like Chrome go to feed without problem

For example 3DNews - новости, софт

Problem is only with tt-rss

fox · 2021-10-01T11:10:08.956Z

Scaner:

I wish you not to get help when you will ask it too

enjoy your probation.

e: closing this in favor of the stickied one.

fox · 2021-10-02T06:21:13.154Z