Portainer OAuth failure with self-signed certificate

[diasdmhub]

Ask a Question!

I'm trying to use "Authentik" to log in to my Portainer instance.
Authentik uses a self-signed certificate which I created as "authentik.domain.name".
I also configured the "Brand" domain and set the certificate for Web interface and clients.

I've followed the setup instructions for both Portainer and Authentik, and everything seems correct. I created an application in Authentik and attached it to an OAuth provider. Then, configured the OAuth authentication in Portainer using the Authentik provider URLs. However, whenever I try to log in to Portainer using OAuth, I receive the error message "Failure - Unauthorized".

I'm not exposing my environment outside my LAN, and for now I don't require a trusted certificate such as Let's Encrypt. So, I think the self-signed certificate may be the cause of the failure.

With podman logs portainer, I see the following error message:

2025/09/07 12:46AM ERR github.com/portainer/portainer-ee/api/oauth/oauth.go:27 > failed retrieving OAuth token | error="Post \"https://authentik.domain.name:19443/application/o/token/\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

How can I fix this?

[Nick-Portainer]

Hi @diasdmhub I use Authentik with my Portainer environment but I do use Nginx Proxy Manager and a Pi-Hole to manage DNS so I can run SSL for my services, this works without issues and I would recommend this approach.

But if you wish to use self-signed certs you will need to provide these to Portainer so it's aware of them. - https://portal.portainer.io/knowledge/how-can-i-use-my-custom-certificate-authority-ca-with-portainer

[Shandeika]

I have the same problem, but the certificate is for sso.example.com Let's Encrypt has been issued. What could be the problem? I use ZITADEL

2025/11/10 12:22PM ERR github.com/portainer/portainer-ee/api/oauth/oauth.go:27 > failed retrieving OAuth token | error="Post \"https://sso.example.com/oauth/v2/token\": tls: failed to verify certificate: x509: certificate signed by unknown authority"