running ca in docker does - using intermediate and root certificate failes

[pcace]

Hi there,

its very possible that i have just not understood the manual correctly, i am just starting to figure out how to use smallstep.
here is my probkem. i have followed the quickstart here: https://hub.docker.com/r/smallstep/step-ca
to install step-ca in my docker environment.

docker run -d --name smallstep-ca \ -v step:/home/step \ -p 9000:9000 \ -e "DOCKER_STEPCA_INIT_NAME=Smallstep" \ -e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \ -e "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT=true" \ -e "DOCKER_STEPCA_INIT_SSH=true" \ --restart unless-stopped \ smallstep/step-ca

then i did follow up with:

{
  CA_FINGERPRINT=$(docker run -v step:/home/step smallstep/step-ca step certificate fingerprint certs/root_ca.crt)
  step ca bootstrap --ca-url https://localhost:9000 --fingerprint $CA_FINGERPRINT --install
}

✔ Would you like to overwrite /root/.step/certs/root_ca.crt [y/n]: y█
The root certificate has been saved in /root/.step/certs/root_ca.crt.
✔ Would you like to overwrite /root/.step/config/defaults.json [y/n]: y
The authority configuration has been saved in /root/.step/config/defaults.json.
Installing the root certificate in the system truststore... done.

and tried this:

curl https://localhost:9000/health

but get the error that the certificate is wrong:

(base) root@beta:~# curl --cacert /root/.step/certs/root_ca.crt https://localhost:9000/health
{"status":"ok"}
(base) root@beta:~# curl  https://localhost:9000/health
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
(base) root@beta:~# 

from my understanding i need the full chain for curl to be able to accept the certificate. so root + intermediate certififate.

if that understanding is correct, what am i doing wrong here or how can i configure the machine to trust the whole chain? or do i need to reconfigure the step config?

any help would be great how to proceed from here!

the goal is to use smallstep to manage ssh keys for servers and users.

thanks a lot for help and ideas!

[hslatman]

Hey @pcace, your first curl invocation using --cacert actually shows that it is working. In that case you're specifying that curl should use (just) the root CA that's in the file, which happens to be your Step CA root, and thus the request succeeds.

From the part just before that, it seems that the certificate was installed successfully, but maybe it was put in the wrong place and/or maybe curl doesn't locate the installed root certificate correctly. What operating system are you using? Can you look for the CA certificates that were installed through e.g. update-ca-certificates in the locations for your OS to see if the Step CA root is there?

That said, just using curl with --cacert is fine too.