Curl Command Failing - SSL Certificate (Exit Code 60) Inside Docker Container Running on Windows Machine

user_15264623 0
Viewed 4538

There is a shell script that builds a Docker Image (calling a Dockerfile). In the Dockerfile there are several CURL commands like this: The Docker Container is using base OS as : Debian GNU/Linux 10

RUN curl -s -L \
    https://repo1.maven.org/ ...

RUN curl -s -L \
    https://github.com/CodeNarc/ ... \
    -o codenarc.jar

RUN curl -s -L \
    https://repo1.maven.org/ ...

RUN curl -s -L \
    https://repo1.maven.org/ ...

The above Dockerfile is running fine when the host machine is either Mac or Linux based.

But when we are trying to run this on Windows host machine the 2nd curl command i.e. to “github.com” is failing with SSL Certificate issue (Exit Code 60).

We are not doing anything related to PHP, so any such solution (related to php.ini file) is irrelevant for me.

Now I have tried almost everything available to solve this issue but nothing seems to be working:

  1. Downloading cacert.pem file from given location and putting into “/etc/ssl/certs”, but it didn’t work
  2. I tried using update-ca-certificate, but it didn’t work
  3. Used --cacert <cacert.pem file location on docker container>, but this also didn’t work

The only solution working is with -k flag in curl command, but that is insecure and we don't want to use that. I cant find any other solution for this, if anyone can help, it will be much appreciated.

Thanks

Adding on what I tried running openssl s_client -showcerts -connect github.com:443 on Windows Host Machine:

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3851 bytes and written 438 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 441C92CFBEA27773315E4A9476C3A5173F0A2AB0AADDE708568DD8752EAA8A5A
    Session-ID-ctx:
    Master-Key: DF6DB0BC64F84ADD5974694845136249AEBEFB2559009AAD2A5C27A6FC981915AB50A765914CAA8AFCAC904B9998FF54
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1614064531
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: no
---
depth=2 C = US, O = "Blue Coat Systems, Inc.", CN = Cloud Services CA - G2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = Cloud Services, OU = Operations, CN = SSL-SG1-GINCH7
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
verify return:1

Then I ran the same command from inside the Docker:

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3851 bytes and written 438 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 441C92CFBEA27773315E4A9476C3A5173F0A2AB0AADDE708568DD8752EAA8A5A
    Session-ID-ctx:
    Master-Key: DF6DB0BC64F84ADD5974694845136249AEBEFB2559009AAD2A5C27A6FC981915AB50A765914CAA8AFCAC904B9998FF54
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1614064531
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: no
---
depth=2 C = US, O = "Blue Coat Systems, Inc.", CN = Cloud Services CA - G2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = Cloud Services, OU = Operations, CN = SSL-SG1-GINCH7
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
verify return:1
docker curl shell ssl-certificate
1 Answers

Whatever is the problem, it is not related to the container itself, otherwise it will not work on Linux and macOS as well (providing the test was done in the same network). The problem could be in the Windows host or the network in which the host is residing.

Check the following:

  1. Antivirus or a proxy running on the windows machine
  2. Corporate firewall
  3. Content/packet inspectors (DPI)
  4. Trace the connection with tpcpdump / wireshark from both hosts and compare the traffic

Also, see which certificate is the problem with openssl s_client -showcerts -connect github.com:443 to find which certificate is the problem

user_28167030
Related