starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

After updating to 0.22.2, headscale refuses let's encrypt certificates #508

New Issue
Closed
opened 2025-12-29 02:19:18 +01:00 by adam · 4 comments
adam commented 2025-12-29 02:19:18 +01:00
Owner
Copy Link

Originally created by @kolaente on GitHub (May 11, 2023).

Bug description

After upgrading to 0.22.2 (from 0.22.1) headscale refuses to start. I see this message in the logs:

server_1  | 2023-05-11T20:19:46Z FTL go/src/headscale/cmd/headscale/cli/server.go:21 > Error initializing error="Get \"https://auth.domain.tld/application/o/headscale/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

The certificate on the auth provider uses a let's encrypt certificate. I can view the site in my browser without problems. Downgrading to 0.22.1 again seems to fix it.

Environment

  • OS: Docker image
  • Headscale version: 0.22.2
  • Tailscale version: probably not relevant?
  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Both are the case here, but I doubt that's a cause of the problem? Also since this is the official image I kind of assume it's within the scope of the project?

To Reproduce

Update to 0.22.2 from 0.22.1, use a Let's Encrypt certificate on a third party auth provider.

Originally created by @kolaente on GitHub (May 11, 2023). <!-- Before posting a bug report, discuss the behaviour you are expecting with the Discord community to make sure that it is truly a bug. The issue tracker is not the place to ask for support or how to set up Headscale. Bug reports without the sufficient information will be closed. Headscale is a multinational community across the globe. Our language is English. All bug reports needs to be in English. --> ## Bug description <!-- A clear and concise description of what the bug is. Describe the expected bahavior and how it is currently different. If you are unsure if it is a bug, consider discussing it on our Discord server first. --> After upgrading to 0.22.2 (from 0.22.1) headscale refuses to start. I see this message in the logs: ``` server_1 | 2023-05-11T20:19:46Z FTL go/src/headscale/cmd/headscale/cli/server.go:21 > Error initializing error="Get \"https://auth.domain.tld/application/o/headscale/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority" ``` The certificate on the auth provider uses a let's encrypt certificate. I can view the site in my browser without problems. Downgrading to 0.22.1 again seems to fix it. ## Environment <!-- Please add relevant information about your system. For example: - Version of headscale used - Version of tailscale client - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version - Kernel version - The relevant config parameters you used - Log output --> - OS: Docker image - Headscale version: 0.22.2 - Tailscale version: probably not relevant? <!-- We do not support running Headscale in a container nor behind a (reverse) proxy. If either of these are true for your environment, ask the community in Discord instead of filing a bug report. --> - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container Both are the case here, but I doubt that's a cause of the problem? Also since this is the official image I kind of assume it's within the scope of the project? ## To Reproduce <!-- Steps to reproduce the behavior. --> Update to 0.22.2 from 0.22.1, use a Let's Encrypt certificate on a third party auth provider.
adam added the bug label 2025-12-29 02:19:18 +01:00
adam closed this issue 2025-12-29 02:19:19 +01:00
adam commented 2025-12-29 02:19:19 +01:00
Author
Owner
Copy Link

@gtjadsonsantos commented on GitHub (May 11, 2023):

I am with this problem too

@gtjadsonsantos commented on GitHub (May 11, 2023): I am with this problem too
adam commented 2025-12-29 02:19:19 +01:00
Author
Owner
Copy Link

@6ixfalls commented on GitHub (May 11, 2023):

Issue seems to be with the new base image change, bullseye-slim doesn't contain ca-certificates by default AFAIK. Will test and create a PR if so.

@6ixfalls commented on GitHub (May 11, 2023): Issue seems to be with the new base image change, bullseye-slim doesn't contain ca-certificates by default AFAIK. Will test and create a PR if so.
adam commented 2025-12-29 02:19:19 +01:00
Author
Owner
Copy Link

@arnonh commented on GitHub (May 12, 2023):

Just to help others, It will refuse any certificate so for me oidc with google stopped working until i downgraded back to 0.22.1

@arnonh commented on GitHub (May 12, 2023): Just to help others, It will refuse any certificate so for me oidc with google stopped working until i downgraded back to 0.22.1
adam commented 2025-12-29 02:19:20 +01:00
Author
Owner
Copy Link

@sunny-logic commented on GitHub (Apr 9, 2024):

Sorry to comment here on a closed issue but just wanted to check if the "v0.23.0-alpha5-debug" have the ca-certificates added because I see the below error, thanks.

ERR Could not load DERP map from path error="Get \"https://controlplane.tailscale.com/derpmap/default\": tls: failed to verify certificate: x509: certificate signed by unknown authority" func=GetDERPMap url=https://controlplane.tailscale.com/derpmap/default

@sunny-logic commented on GitHub (Apr 9, 2024): Sorry to comment here on a closed issue but just wanted to check if the "v0.23.0-alpha5-debug" have the ca-certificates added because I see the below error, thanks. ` ERR Could not load DERP map from path error="Get \"https://controlplane.tailscale.com/derpmap/default\": tls: failed to verify certificate: x509: certificate signed by unknown authority" func=GetDERPMap url=https://controlplane.tailscale.com/derpmap/default`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#508
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?