{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 该账号已被封号 的问题《SSL certificate verification fails inside docker c》','https://www.manongdao.com/q-1274684.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
I'm running into a strange problem with certificates that I can't figure out how to debug. When I run wget inside of a docker container on one specific server it cannot verify certificates. The same wget works fine on the server machine itself (outside docker) and it works inside that same docker container on different servers.
Here's the setup for the docker container:
docker run --rm -ti debian:jessie bash
apt-get update
apt-get install wget
wget https://google.com
The response is:
converted 'https://google.com' (ANSI_X3.4-1968) -> 'https://google.com' (UTF-8)
--2016-06-22 14:22:02-- https://google.com/
Resolving google.com (google.com)... 216.58.217.142, 2607:f8b0:4004:807::200e
Connecting to google.com (google.com)|216.58.217.142|:443... connected.
ERROR: The certificate of 'google.com' is not trusted.
ERROR: The certificate of 'google.com' hasn't got a known issuer.
The certificate's owner does not match hostname 'google.com'
Since this same process works on other servers, it seems like the problem could only be some certificate problem on that server itself. But I must be confused: why should the certificates on the server itself have anything to do with what's happening inside of the docker container?
I would really appreciate any insight into this, in particular any debugging steps I can take to understand the problem better.
Docker uses iptables.
If you have iptable rules set up it's possible to direct EVERY https request to your own running server.
If you are, for example, running jenkins locally and using iptables to redirect 443 to default 8080 port than all your container traffic to port 443 ports will be redirected to that local jenkins server which will be unable to verify your certificate. We ran into this problem when using Jenkins to build our docker images. our jenkins used iptables to get around running jenkins as root.
It seems that the certificates are out of date inside the jessie image.
try
apt-get install ca-certificatesbefore the wgetThis worked fine for me, though to be safe, make sure your "ca-certificates" package is up to date. Most likely, you have some kind of security device on the network that is inspecting the traffic, and to do so, decrypting and encrypting with it's own certificate. Here's the certificate I get from my own testing:
To make this work on your own network, you'll need to add the CA from your local security appliance into your container: