You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The OIDC_PUBLIC_KEY is a key used for token singing, not for the TLS used in the HTTPS connection.
We don't provide an option to define a custom TLS CA for the HTTPS connection.
Generally I'd advise adding the certificate to the host system's trusted root CA store, but not sure on the best way to go about that that for an alpine-based container.
I think the linuxserver images do allow adding start-up scripts somehow so might be way to add it to the store via those.
Hi Dan,
many thanks for your help. I really missunderstood. Now I mount the system certs into container and it works. Got rid of curl error 60 and authentication via Keycloak works too.
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
Using Bookstack in docker container.
Try to use Keycloak for Authentication and get error
[2024-03-30 12:47:07] production.ERROR: cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://keycloak35.intra.xxxxxx.yyyyyy.de:8443/realms/bookstack/protocol/openid-connect/token {"exception":"[object] (GuzzleHttp\Exception\RequestException(code: 0): cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://keycloak35.intra.xxxxxx.yyyyyy.de:8443/realms/bookstack/protocol/openid-connect/token at /app/www/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php:211)
[stacktrace]
Path to key is configured:
Path to identity provider token signing public RSA key
OIDC_PUBLIC_KEY=file:///config/keys/CA-POL2023.chain
Volume is set:
-v /srv/bookstack:/config
Try it in container:
docker exec -it bookstack /bin/bash
Using same file as used in .env
curl --cacert /config/keys/CA-POL2023.chain https://keycloak35.intra.xxxxxx.yyyyyy.de:8443/realms/bookstack/protocol/openid-connect/token
{"error":"HTTP 405 Method Not Allowed","error_description":"For more on this error consult the server log at the debug level."}
=> no ssl error. Therefor it's correct file. But why I get the curl error 60 for for the token URL? The auth endpoint is without ssl error.
Exact BookStack Version
v24.02.2
Log Content
Details
Hosting Environment
Docker on Suse Linux Enterprise Server 15 SP 5 actual patches installed
The text was updated successfully, but these errors were encountered: