docker应用出现x509: certificate signed by unknown authority

发表于   |   分类于 linux , go , docker   |   暂无评论

根本原因

  • 此错误消息表示您没有受信任的证书，例如，如果在安装期间未提供证书，则由DTR生成的默认自签名证书。

解决方案

  • 连接的时候不验证服务端证书
    import (
      "crypto/tls"
      "net/http"
    )
    func main() {
        transport := &http.Transport{
            TLSClientConfig:    &tls.Config{
                InsecureSkipVerify: true//true不验证服务器证书
            },
        }
        client := &http.Client{Transport: transport}
        resp, err := client.Get("https://www.timiguo.com:8081")
    }
  • 在dockerfile里更新证书
  RUN apk update \
        && apk upgrade \
        && apk add --no-cache \
        ca-certificates \
        && update-ca-certificates 2>/dev/null || true
  • 挂在系统证书目录
    golang查找公共根证书的路径，根据自己的系统挂在对应目录上去即可
"/etc/ssl/certs/ca-certificates.crt",                // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
"/etc/pki/tls/cacert.pem",                           // OpenELEC
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
"/etc/ssl/certs",               // SLES10/SLES11
"/system/etc/security/cacerts", // Android
"/usr/local/share/certs",       // FreeBSD
"/etc/pki/tls/certs",           // Fedora/RHEL
"/etc/openssl/certs",           // NetBSD
添加新评论