Closed aingestigate closed 1 month ago
I would love to use your project, but when people indicate there is a bug or flaw in the software, it very often seems that no one responds, at all. Can I please get a response to the above?
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
I'm now facing the same issue.. So I guess I'm pushing this.
To me it seems that outposts don't trust the Authentik instance if the authentik instance is using self-signed certs.. We'd need to know of a way to supply the certificate.
I'd also triage this as a Bug:
Authentik should deploy it's trusted certificates to outposts it deploys from the UI
@aingestigate I found this on the deployment info in the UI. There's an environment variable that allows setting it insecure
Nontheless I want the outpost to either recognize my self-signed root CA or at least disable not needed external ports
Hello Authentik Team,
I am experiencing persistent SSL certificate verification issues when configuring LDAP outposts in my Docker environment. Despite following the recommended practices for secure connections and proper DNS naming conventions, I continue to encounter the error: "tls: failed to verify certificate: x509: certificate signed by unknown authority".
Steps to Reproduce:
Expected Behavior: The LDAP outpost should establish a secure connection without SSL errors.
Actual Behavior: The connection repeatedly fails with SSL verification errors, even after ensuring the full certificate chain is trusted and correctly set up in the environment.
Environment:
Additional Context: I’ve tried various configurations, including changing service names to be DNS-compliant and explicitly trusting the self-signed certificate within the container’s trust store. A similar issue was discussed in Issue #7624, but no definitive resolution was documented. Additionally -- I have access to the UI of authentik, am able to create users, etc. I set up the various flows, stages, applications, providers, and outposts according to the documentation.
In the end, the
authentik-ldap
container is unable to connect, continually showing this error:{"error":"Get \"https://authentik-server:9443/api/v3/outposts/instances/\": tls: failed to verify certificate: x509: certificate signed by unknown authority","event":"Failed to fetch outpost configuration, retrying in 3 seconds","level":"error","logger":"authentik.outpost.ak-api-controller","timestamp":"2024-05-24T20:23:20Z"}
And tests within the
authentik-worker
container are failing, as follows:I generated additional certificate key pairs within the UI of Authentik, and uploaded them to the bind-mounted
/certs
directory. I can see that they were "discovered" via the UI. Nonetheless, it appears that the server insists on using the "generic" self-signed cert that is auto-created, and even if I delete it and restart the stack, it generates a new one.Could you please advise on potential steps to resolve this issue or confirm if this might be a bug in the current version?
Thank you for your assistance.
Feel free to customize this draft with more specific details about your configuration and any other observations you think are relevant. This should give the developers a clear understanding of the issue and the context needed to investigate further.