starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Trusted self-signed certificate can't be used connecting to OIDC server #127

New Issue
Closed
opened 2025-12-29 01:23:37 +01:00 by adam · 3 comments
adam commented 2025-12-29 01:23:37 +01:00
Owner
Copy Link

Originally created by @axlev on GitHub (Feb 20, 2022).

Issue description
Getting 'x509: certificate signed by unknown authority' from headscale although the cert is self signed it is trusted by OS
To Reproduce
Use self-signed certificate for auth with DEX (probably does not matter which OIDC server to use)
I looked how to disable this by setting InsecureSkipVerify but seems it indeed buried inside oidc.NewProvider at oidc.go:44. May be attached file can help to get some more light .

Context info

Originally created by @axlev on GitHub (Feb 20, 2022). **Issue description** Getting 'x509: certificate signed by unknown authority' from headscale although the cert is self signed it is trusted by OS **To Reproduce** Use self-signed certificate for auth with DEX (probably does not matter which OIDC server to use) I looked how to disable this by setting InsecureSkipVerify but seems it indeed buried inside oidc.NewProvider at oidc.go:44. May be attached file can help to get some more light . **Context info** <!-- Please add relevant information about your system. For example: - Version of headscale used: headscale_0.12.4_linux_amd64 - Version of tailscale client: 1.21.1 - OS: Ubuntu 20.04 - Kernel version : 5.13.0-28-generic - The relevant config parameters you used - Log output [failed_tls.txt](https://github.com/juanfont/headscale/files/8103527/failed_tls.txt) Attached correspondence from discord as well: ![issue](https://user-images.githubusercontent.com/24719762/154831807-8199818d-15a5-439b-9fa6-8bc4069577a5.png) As a workaround it is possible to use CA signed certificate. -->
adam added the bug label 2025-12-29 01:23:37 +01:00
adam closed this issue 2025-12-29 01:23:38 +01:00
adam commented 2025-12-29 01:23:39 +01:00
Author
Owner
Copy Link

@mpldr commented on GitHub (Apr 11, 2022):

Unfortunately TOFU is very uncommon for HTTP. What OS are you using and how have you added your CA Cert?

@mpldr commented on GitHub (Apr 11, 2022): Unfortunately TOFU is very uncommon for HTTP. What OS are you using and how have you added your CA Cert?
adam commented 2025-12-29 01:23:39 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Sep 8, 2022):

I do not think we can prioritise this issue, going to close for now.

@kradalby commented on GitHub (Sep 8, 2022): I do not think we can prioritise this issue, going to close for now.
adam commented 2025-12-29 01:23:39 +01:00
Author
Owner
Copy Link

@baumheld commented on GitHub (Nov 1, 2024):

Facing the same dead end. I wanted to try out headscale locally on my machine using docker. Additionally I wanted to use my OIDC provider authelia

In my docker compose I configure these 3 services

  • Headscale (VPN)
  • traefik (reverse proxy)
  • authelia (OIDC provider)

For local testing I use a self signed developer cert. I bake them into docker Images using this

Headscale Dockerfile

FROM alpine AS cert-builder

# Install self signed cert inside a dummy container
RUN apk --quiet --update-cache add ca-certificates 
COPY ./certs/rootCA.pem /usr/local/share/ca-certificates/rootCA.crt
RUN update-ca-certificates

FROM headscale/headscale:latest-debug

# Copy self signed cert over to headscale
COPY --from=cert-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY ./certs/public.crt /certs/public.crt
COPY ./certs/private.key /certs/private.key

Authelia Dockerfile

FROM authelia/authelia:latest

# Install self signed cert
RUN apk --quiet --update-cache add ca-certificates 
COPY ./certs/rootCA.pem /usr/local/share/ca-certificates/rootCA.crt
COPY ./certs/private.key /certs/private.key
COPY ./certs/public.crt /certs/public.crt
RUN update-ca-certificates

But in the end headscale complains like stated by OP with x509: certificate signed by unknown authority in its logs when trying to spin up and connect a tailscale client to headscale

I'm stuck :(

@baumheld commented on GitHub (Nov 1, 2024): Facing the same dead end. I wanted to try out headscale locally on my machine using docker. Additionally I wanted to use my OIDC provider authelia In my docker compose I configure these 3 services - Headscale (VPN) - traefik (reverse proxy) - authelia (OIDC provider) For local testing I use a self signed developer cert. I bake them into docker Images using this ### Headscale Dockerfile ``` FROM alpine AS cert-builder # Install self signed cert inside a dummy container RUN apk --quiet --update-cache add ca-certificates COPY ./certs/rootCA.pem /usr/local/share/ca-certificates/rootCA.crt RUN update-ca-certificates FROM headscale/headscale:latest-debug # Copy self signed cert over to headscale COPY --from=cert-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY ./certs/public.crt /certs/public.crt COPY ./certs/private.key /certs/private.key ``` ### Authelia Dockerfile ``` FROM authelia/authelia:latest # Install self signed cert RUN apk --quiet --update-cache add ca-certificates COPY ./certs/rootCA.pem /usr/local/share/ca-certificates/rootCA.crt COPY ./certs/private.key /certs/private.key COPY ./certs/public.crt /certs/public.crt RUN update-ca-certificates ``` But in the end headscale complains like stated by OP with `x509: certificate signed by unknown authority` in its logs when trying to spin up and connect a tailscale client to headscale I'm stuck :(
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#127
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?