I've written a little proxy ASP.NET Core Web API app (see here) that is running on my Raspberry Pi within a Linux Docker container. The app runs under http://raspberry.fritz.box:5200/joplin and forwards all requests to https://nas.fritz.box:9815.
Using XCA, I've created a custom Root CA and a HTTPS certificate for nas.fritz.box. I've successfully registered the custom Root CA certificate within my Raspberry Pi and curl https://nas.fritz.box works without any problems.
But within the Docker container, the TLS certificate validation fails. I assume that either Kestrel or the Docker container have their own certificate store.
So I'd like to achieve the following:
- I can access my app via HTTPS (
https://raspberry.fritz.box:5200/joplininstead ofhttp://raspberry.fritz.box:5200/joplin) without certification validation errors. - Requests towards
https://nas.fritz.box:9815do not fail within my app running in the Docker container.
I assume that the solution to both issues lies in providing the correct certificate(s). But I don't see the path: do I have to provide a single certificate only for raspberry.fritz.box with the complete certificate chain? Or two independent certificates (for raspberry.fritz.box and the custom Root CA)? And how to I have to configure it?
I've already read the Microsoft documentation, but I still don't get it.
For the sake of completeness: my app runs behind a reverse proxy (nginx) and will be accessed via https://raspberry.fritz.box/joplin in production, where nginx forwards all requests internally to http://raspberry.fritz.box:5200/joplin. Since I've configured both my custom Root CA and the HTTPS certificate for nginx on my Raspberry Pi, I can run curl https://raspberry.fritz.box/joplin from my production machine without any problem.