ListenAndServeTLS在本地运行-X509:在docker中由未知授权机构签署的证书

Question

我正在使用mkcert生成一个自签名的证书和权限。当我用ListenandServetls在本地使用这些文件时，我可以成功地用curl连接。我的主机是macos。

但是，当尝试在docker容器中运行此Go代码时，我得到以下错误：

X509:由未知授权机构签署的证书

mkcert -cert-file ./cert.pem -key-file ./key.pem localhost

    // Load cert + key.
    cert, _ := tls.LoadX509KeyPair("cert.pem", "key.pem")

    // Load our CA. (Mkcert also generates this btw, check the docs).
    caCert, _ := ioutil.ReadFile("rootCA.pem")

    // Add our CA so it's considered an acceptable rootCA.
    rootCAs, _ := x509.SystemCertPool()
    rootCAs.AppendCertsFromPEM(caCert)

    server := http.Server{
        Addr:    ":1234",
        Handler: router,
        TLSConfig: &tls.Config{
            Certificates: []tls.Certificate{cert},
            RootCAs:      rootCAs,
        },
    }

    _ = server.ListenAndServeTLS("", "")

ARG GO_VERSION=1.14

FROM golang:${GO_VERSION}-alpine AS builder

RUN apk add --no-cache ca-certificates git curl

ENV CGO_ENABLED=0

WORKDIR /app

COPY go.mod .
COPY go.sum .
RUN go mod download

COPY . /app

RUN go build -o ./bin/app .

FROM alpine AS final

WORKDIR /app

COPY --from=builder /user/group /user/passwd /etc/

COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

COPY --from=builder /app/bin/app /app

ENTRYPOINT ["./app"]

    my-app:
        build:
            context: ./
            dockerfile: Dockerfile
        ports:
            - 1234:1234

当运行上述容器并通过TLS连接时，我得到上面描述的未知权限错误。

我错过了什么？

Answer 1

问题在于您的多阶段DockerFile。在第一阶段复制所有必需的构件（源代码、证书等）时，在最后阶段只复制二进制bin/app:

COPY --from=builder /app/bin/app /app

您还需要复制服务运行时使用的PEM文件：

COPY --from=builder \
    /app/cert.pem \
    /app/key.pem  \
    /app/rootCA.pem \
        /app/

无论一个操作看起来多么微不足道，总是检查错误（和布尔返回）：

cert, err := tls.LoadX509KeyPair("cert.pem", "key.pem")
if err != nil {
    log.Fatalf("failed to load server key pairs: %v", err)
}

rootCAs, err := x509.SystemCertPool()
if err != nil {
    log.Fatalf("failed to load system keychain: %v", err)
}

caCert, err := ioutil.ReadFile("rootCA.pem")
if err != nil {
    log.Fatalf("failed to read CA trust file rootCA.pem: %v", err)
}

ok := rootCAs.AppendCertsFromPEM(caCert)
if !ok {
    log.Fatal("failed to load CA trust: bad PEM format?")
}

log.Fatalf(
    "server error: %v",  // e.g. "port in use" 
    server.ListenAndServeTLS("", ""),
)