Go API部署在GKE上时出现SSL错误:无法验证第一个证书。我是否遗漏了什么?

huangapple go评论91阅读模式
英文:

Go API deployed on GKE throws SSL Error: Unable to verify the first certificate . Am I missing something?

问题

以下是我的Kubernetes配置。当客户端禁用SSL验证或使用HTTP而不是HTTPS时,使用此配置部署的API按预期工作。但是在启用时,它会抛出SSL错误:无法验证第一个证书。SSL证书文件已添加为Kubernetes密钥,并且API在端口8080上公开。

---
apiVersion: "v1"
kind: "ConfigMap"
metadata:
  name: "test-config"
  namespace: "default"
  labels:
    app: "test"
data:
  ENV: "DEV"
---
apiVersion: "apps/v1"
kind: "Deployment"
metadata:
  name: "test"
  namespace: "default"
  labels:
    app: "test"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: "test"
  template:
    metadata:
      labels:
        app: "test"
    spec:
      containers:
        - name: "test"
          image: "gcr.io/test-project/test:latest"
          env:
            - name: "ENV"
              valueFrom:
                configMapKeyRef:
                  key: "ENV"
                  name: "test-config"
---
apiVersion: "extensions/v1beta1"
kind: "Ingress"
metadata:
  name: "test-ingress"
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "test-static-ip"
  labels:
    app: "test"
spec:
  tls:
  - hosts:
      - "test.myhost.com"
    secretName: "test-ssl-certificate"
  backend:
    serviceName: "test-service-nodeport"
    servicePort: 8080
  rules:
  - host: "test.myhost.com"
    http:
      paths:
      - path: "/*"
        backend:
          serviceName: "test-service-nodeport"
          servicePort: 8080
---
kind: "Service"
apiVersion: "v1"
metadata:
  name: "test-service-nodeport"
spec:
  selector:
    app: "test"
  ports:
    - protocol: "TCP"
      port: 8080
      targetPort: 8080
  type: "NodePort"

Go服务器代码

http.HandleFunc("/hello", HelloServer)
err := http.ListenAndServeTLS(":8080", "server.crt", "server.key", nil)
if err != nil {
    log.Fatal("ListenAndServe: ", err)
}
英文:

Following is my Kubernetes configuration. The API deployed using this config works as expected when SSL verification is disabled by the client or when HTTP is used instead of HTTPS. But on enabling, it throws SSL Error: Unable to verify the first certificate. The SSL certificate files are added as Kubernetes secret and the API is exposed on port 8080.

---
apiVersion: "v1"
kind: "ConfigMap"
metadata:
name: "test-config"
namespace: "default"
labels:
app: "test"
data:
ENV: "DEV"
---
apiVersion: "apps/v1"
kind: "Deployment"
metadata:
name: "test"
namespace: "default"
labels:
app: "test"
spec:
replicas: 1
selector:
matchLabels:
app: "test"
template:
metadata:
labels:
app: "test"
spec:
containers:
- name: "test"
image: "gcr.io/test-project/test:latest"
env:
- name: "ENV"
valueFrom:
configMapKeyRef:
key: "ENV"
name: "test-config"
---
apiVersion: "extensions/v1beta1"
kind: "Ingress"
metadata:
name: "test-ingress"
annotations:
kubernetes.io/ingress.global-static-ip-name: "test-static-ip"
labels:
app: "test"
spec:
tls:
- hosts:
- "test.myhost.com"
secretName: "test-ssl-certificate"
backend:
serviceName: "test-service-nodeport"
servicePort: 8080
rules:
- host: "test.myhost.com"
http:
paths:
- path: "/*"
backend:
serviceName: "test-service-nodeport"
servicePort: 8080
---
kind: "Service"
apiVersion: "v1"
metadata:
name: "test-service-nodeport"
spec:
selector:
app: "test"
ports:
- protocol: "TCP"
port: 8080
targetPort: 8080
type: "NodePort"

Go server code

http.HandleFunc("/hello", HelloServer)
err := http.ListenAndServeTLS(":8080", "server.crt", "server.key", nil)
if err != nil {
log.Fatal("ListenAndServe: ", err)
}

答案1

得分: 0

这可能是由于服务器上的中间证书未正确安装导致证书链断裂的潜在原因。即使在您的浏览器中可以正常工作,也可能没有包含用于缓存清空客户端验证所需的所有公共证书链。以下是一些初步的故障排除步骤:

  1. 确认您的证书链完整性 [https://certificatechain.io/ ]
  2. 验证您的服务器配置 [https://www.ssllabs.com/ssltest/https://www.sslshopper.com/ssl-checker.html]
  3. 查找以下错误:
    • This server's certificate chain is incomplete.
    • Chain issues.........Incomplete

如果遇到这些问题,意味着您连接的Web服务器配置错误,并且在发送给您的证书链中省略了中间证书。您的服务器需要同时提供您的域的证书和中间证书。

中间证书应与服务器证书一起安装在服务器上。根证书嵌入在软件应用程序、浏览器和操作系统中。提供证书的应用程序必须发送完整的证书链,包括服务器证书本身和所有中间证书。

请参考Stack Overflow帖子将服务器证书和中间证书合并为链式证书获取更多信息。

英文:

A potential cause for this could be intermediate certificates were not installed on the server properly which caused a breakdown in the certificate chain. Even if it works in your browser, it may not be including all the public certificates in the chain needed for a cache-empty client to verify. Here are some preliminary troubleshooting steps:

Verify that your certificate chain is complete [https://certificatechain.io/ ]

Verify your server’s configuration [https://www.ssllabs.com/ssltest/ or https://www.sslshopper.com/ssl-checker.html ]

Look for this error:
This server's certificate chain is incomplete.
And this:
Chain issues.........Incomplete

If you encounter these issues, it means that the web server you are connecting to is misconfigured and did omit the intermediate certificate in the certificate chain it sent to you. Your server needs to serve not just the certificate for your domain, but also the intermediate certificates too.

Intermediate certificate should be installed on the server, along with the server certificate. Root certificates are embedded into the software applications, browsers and operating systems. The application serving the certificate has to send the complete chain, this means the server certificate itself and all the intermediates.

Refer stack post and combine the server certificate and intermediate certificate into a chained certificate for information.

huangapple
  • 本文由 发表于 2021年7月30日 22:28:04
  • 转载请务必保留本文链接:https://go.coder-hub.com/68592657.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定