Comments (3)
First of all,
Thank you @gregnr, I completely misread that you are the maintainer.
sorry about it and a huge thank you for taking the time to work on this nonetheless.
Seriously. Thank you so much.
This works now, and all our services are reachable again.
I had docker throw an execution error of the .sh script.
Fixed it by chmod -x the .sh script and changing
ENTRYPOINT ["sh","/usr/local/openresty/bootstrap.sh"]
in the Dockerfile.
from docker-oidc-proxy.
Hi,
Unfortunately I don't have a solution, just wanted to let you know that I'm running into a very similar problem.
I'm getting
There was an error while logging in: accessing discovery url (https://xxx/auth/realms/xxx/.well-known/openid-configuration) failed: 10: certificate has expired
The logs said that this problem first appeared on 30th Sep, which I think is most likely related to this issue:
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
Any ideas how that could get fixed @gregnr ?
from docker-oidc-proxy.
@nt7 I'm not the primary maintainer of this project, but I'm happy to give my two cents as I have had to deal with lots of Docker issues relating to the DST Root CA expiring.
First I would say that I agree that your issue is most likely caused by the old Let's Encrypt CA expiring September 30 and that this is different than the issue @JeremyMahieu had which was back in 2020 (I don't have a fix for that one).
Essentially the root cause is that the evry/oidc-proxy
Docker image is too old, and therefore has an out-of-date list of trusted root CA's. We can reproduce your error using curl
:
$ docker run --rm -it --entrypoint="" evry/oidc-proxy curl -I https://letsencrypt.org/
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
(We're testing against https://letsencrypt.org/ because they use a LE certificate for their own website - replace this with your discovery URL and you should get the same result).
Looking at the Dockerfile
we can see that evry/oidc-proxy
is currently based off of openresty/openresty:1.13.6.2-alpine
which was last updated 2 years ago. If we replace this with the latest version, we solve the problem:
Dockerfile:
- FROM openresty/openresty:1.13.6.2-alpine
+ FROM openresty/openresty:1.19.9.1-2-alpine
...
$ docker build -t evry/oidc-proxy .
$ docker run --rm -it --entrypoint="" evry/oidc-proxy curl -I https://letsencrypt.org/
HTTP/2 200
...
This project appears mostly unmaintained by the original author but I've created a PR/branch you can use for now:
#21
from docker-oidc-proxy.
Related Issues (14)
- Releases on github and docker hub HOT 3
- SSL error - self signed certs HOT 1
- oidc proxy can't run in Openshift
- Reverse proxy question
- Persistent keycloak HOT 1
- OIDCCryptoPassphrase
- Site freezes after few minutes of inactiveness HOT 1
- Helm chart for deployment
- WSS Support
- README HOT 1
- The OID_REDIRECT_PATH == http://localhost/<the_value_from_OID_REDIRECT_PATH> HOT 4
- lua-resty-openidc and checking issuer HOT 2
- There was an error while logging in: request to the redirect_uri path but there's no session state found HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-oidc-proxy.