Hi together, We've deployed moon2 in version 2.5 to k8s but we're ha

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

video-recorder: certificate verify failed: unable to get local issuer certificate about moon HOT 6 CLOSED

toby181 commented on September 26, 2024

video-recorder: certificate verify failed: unable to get local issuer certificate

from moon.

Comments (6)

vania-pooh commented on September 26, 2024 1

Fixed in https://github.com/aerokube/moon2/pull/212. Will be released as Moon 2.5.2.

from moon.

toby181 commented on September 26, 2024

When doing a curl to our s3, which is a MinIO instance, we get this:
curl: (77) error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

from moon.

vania-pooh commented on September 26, 2024

@toby181 you then have to add your TLS certificate provide CA to additional trusted CAs: https://aerokube.com/moon/latest/#ca-certs

from moon.

toby181 commented on September 26, 2024

@vania-pooh
I already did that. I've exported the certificate chain (in total 4 certs) base64 encoded and added it to the additionalTrustedCAs in both the order it was exported and in reversed order.
I've already tried the CA only.

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: &name moon2
  namespace: moon1
spec:
  releaseName: *name
  interval: 5m
  timeout: 15m
  chart:
    spec:
      chart: moon2
      version: 2.5.0
      sourceRef:
        kind: HelmRepository
        name: ...
        namespace: ...
  values:
    quota:
      moon:
        namespace: ...
    ingress:
      enabled: true
      ...
    configs:
      default:
        sessionTimeout: 10m
        additionalTrustedCAs: |
          -----BEGIN CERTIFICATE-----

In the video-recorder pod I'm testing the connection with curl and got the following results.

$ curl https://minio.example.com/
curl: (77) error setting certificate verify locations:  CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none
$ export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
$ curl https://minio.example.com/
-> "AccessDenied" response, which is good

from moon.

vania-pooh commented on September 26, 2024

@aandryashin any ideas?

from moon.