Profile Server: UNABLE_TO_VERIFY_LEAF_SIGNATURE #6
Comments
|
Nevermind, found a way to fix it. Set Otherwise, if no other solution exists, just add it to the readme or something like that. Since someone else will maybe have a setup like this. |
|
Strange, now I'm able to login, but I'm always requested to reconnect. |
|
All the logs that happen on firefox signin. |
|
Have you tried to add Reference: rejectUnauthorized: !args.insecureSSL, |
|
Yeah,
|
|
Ok, found the solution.
After this, things should work as intended with self-signed certs. |
|
Hello @Suika I've made a branch It would be appreciated that you can test this branch. |
|
Since it's a bit of a pain for me to setup another environment ATM, I'll try it at a later date. The rest of REQUESTS_CA_BUNDLE and REQUESTS_CA_BUNDLE make sense, since it works on my side. I'll check the whole setup at a later date. But while I'm at it, is it really needed that the services have to talk via nginx? I know that it's easier to configure it like that and it also makes sense to use uniform addresses everywhere. |
You're right . However it's too time-consuming on distinguish which url in ENV is for internal visit or public visit. I'll try to dig into these deeper in future. |
|
I have tested half of branch. And it works. I use NODE_EXTRA_CA_CERTS and REQUESTS_CA_BUNDLE part in combination with a patched ca-certificates.crt (own root ca added) in all container via volumes. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi, nice seeing that someone tackled the... mess that is fxa.
I think most of the services are running properly except the fxa_fxa-profile-server that has a problem with self-signed certificates.
I'm cheating the whole thing a bit, because I want to serve everything on 80/443 with self-signed certificates and have it go through traefik.
If you look at the Compose file at the bottom it's basically: Me > Browser > traefik (443) > nginx(80) > other services
I mounted the
/etc/ssl:/etc/ssl:roin hopes that the system would pick up on the host Root CAs, but it doesn't seem to do that for Node applications in this case.Any idea?
Response from profileserver
https://fxa-profile.dockerhost.lan/v1/profile:{ "code": 503, "errno": 104, "error": "Service Unavailable", "message": "OAuth server error", "cause": { "code": "UNABLE_TO_VERIFY_LEAF_SIGNATURE" } }From: nginx
From: fxa_fxa-auth-server_1
{"Timestamp":1594313783788000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./account.200","missingFlowId":true}} {"Timestamp":1594313783791000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"oauth.token.created","missingFlowId":true}} {"Timestamp":1594313783796000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./oauth/token.200","missingFlowId":true}} {"Timestamp":1594313783944000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./totp/exists.200","missingFlowId":true}} {"Timestamp":1594313783947000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./recoveryKey/exists.200","missingFlowId":true}} {"Timestamp":1594313783949000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./recovery_emails.200","missingFlowId":true}} {"Timestamp":1594313783976000000,"Logger":"fxa-auth-server","Type":"metricsEvents.emitFlowEvent","Severity":2,"Pid":38,"EnvVersion":"2.0","Fields":{"event":"route./recoveryKey/exists.200","missingFlowId":true}}From: fxa_fxa-auth-db-mysql_1
{ "Timestamp": 1594313686342000000, "Logger": "fxa-auth-db-server", "Type": "bin.server.summary", "Severity": 4, "Pid": 19, "EnvVersion": "2.0", "Fields": { "code": 404, "route": "gettotpid", "method": "GET", "path": "/totp/64d5f8508a044da981f358a1ed1ded99", "err": "Error: Not Found", "t": 2 } }From: fxa_fxa-profile-server
{ "Timestamp": 1594313400523000000, "Logger": "fxa-profile-server", "Type": "server.web.oauth.error", "Severity": 2, "Pid": 8, "EnvVersion": "2.0", "Fields": { "error": "Error: unable to verify the first certificate", "stack": "\n at TLSSocket.onConnectSecure (_tls_wrap.js:1501:34)\n at TLSSocket.emit (events.js:315:20)\n at TLSSocket.EventEmitter.emit (domain.js:482:12)\n at TLSSocket._finishInit (_tls_wrap.js:936:8)\n at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:710:12)" } } { "Timestamp": 1594313400524000000, "Logger": "fxa-profile-server", "Type": "server.summary", "Severity": 2, "Pid": 8, "EnvVersion": "2.0", "Fields": { "code": 503, "method": "get", "errno": 104, "path": "/v1/profile", "agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36", "t": 30, "remoteAddressChain": "[\"10.0.0.103\",\"172.20.0.2\",\"172.20.0.17\"]", "stack": "Error: OAuth server error\n at Function.oauthError (/fxa/packages/fxa-profile-server/lib/error.js:179:10)\n at Request._callback (/fxa/packages/fxa-profile-server/lib/server/web.js:137:42)\n at self.callback (/fxa/node_modules/request/request.js:185:22)\n at Request.emit (events.js:315:20)\n at Request.EventEmitter.emit (domain.js:482:12)\n at Request.onRequestError (/fxa/node_modules/request/request.js:877:8)\n at ClientRequest.emit (events.js:315:20)\n at ClientRequest.EventEmitter.emit (domain.js:482:12)\n at TLSSocket.socketErrorListener (_http_client.js:426:9)\n at TLSSocket.emit (events.js:315:20)\n at TLSSocket.EventEmitter.emit (domain.js:482:12)\n at emitErrorNT (internal/streams/destroy.js:92:8)\n at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)\n at processTicksAndRejections (internal/process/task_queues.js:84:21)" } }copmose:
The text was updated successfully, but these errors were encountered: