starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

CA-Certificate : failed to verify --> unknown source #945

New Issue
Closed
opened 2025-12-29 02:26:32 +01:00 by adam · 3 comments
adam commented 2025-12-29 02:26:32 +01:00
Owner
Copy Link

Originally created by @Nicolas2030 on GitHub (Feb 12, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

In a context of a virtual qemu-kvm machine with MACVTAP network connexion under debian 12 / amd64 Debian 6.1.128-1 x86_64 GNU/Linux behind a firewall.

The firewall fully deployed cannot allow the ca-certificate to be signed by a known authority. So the let's encrypt certificate is self signed and seems not to be verified that way by headscale. This set up is combined with a reverse proxy. the setup worked in the oldest version of headscale (since which version of headscale it has stopped working I don't know...)

here are the message error:

2025-02-11T16:10:21Z FTL ../../../home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="creating OIDC provider from issuer config: Get \"https://dex.nameserver/dex/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

AND @juanfont and the others a big up and thank you for for what you are doing
have a nice day

Expected Behavior

self signed let's encrypt certificate (from unkown source) to be verifed by Open_ID configuration

Steps To Reproduce

basic setup of headscale
leatest yunohost with debian 12

Environment

- OS:deb 12
- Headscale version:0.22
- Tailscale version: ?

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

thanks

Originally created by @Nicolas2030 on GitHub (Feb 12, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior In a context of a virtual qemu-kvm machine with MACVTAP network connexion under debian 12 / amd64 Debian 6.1.128-1 x86_64 GNU/Linux behind a firewall. The firewall fully deployed cannot allow the ca-certificate to be signed by a known authority. So the let's encrypt certificate is self signed and seems not to be verified that way by headscale. This set up is combined with a reverse proxy. the setup worked in the oldest version of headscale (since which version of headscale it has stopped working I don't know...) here are the message error: ``` 2025-02-11T16:10:21Z FTL ../../../home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="creating OIDC provider from issuer config: Get \"https://dex.nameserver/dex/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority" ``` AND @juanfont and the others a big up and thank you for for what you are doing have a nice day ### Expected Behavior self signed let's encrypt certificate (from unkown source) to be verifed by Open_ID configuration ### Steps To Reproduce basic setup of headscale leatest yunohost with debian 12 ### Environment ```markdown - OS:deb 12 - Headscale version:0.22 - Tailscale version: ? ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Anything else? thanks
adam added the stalebug labels 2025-12-29 02:26:32 +01:00
adam closed this issue 2025-12-29 02:26:32 +01:00
adam commented 2025-12-29 02:26:32 +01:00
Author
Owner
Copy Link

@Nathanael-Mtd commented on GitHub (Feb 13, 2025):

I don't know about old versions of Headscale, but I suppose your firewall make TLS decryption to analyze what's inside HTTPS requests.
If you're in that case, did you tried to add your internal decryption CA root inside your VM CA certificates ?

To check if you got TLS decryption certificate , you can use that command : openssl s_client -showcerts -connect dex.nameserver:443

@Nathanael-Mtd commented on GitHub (Feb 13, 2025): I don't know about old versions of Headscale, but I suppose your firewall make TLS decryption to analyze what's inside HTTPS requests. If you're in that case, did you tried to add your internal decryption CA root inside your VM CA certificates ? To check if you got TLS decryption certificate , you can use that command : `openssl s_client -showcerts -connect dex.nameserver:443`
adam commented 2025-12-29 02:26:32 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 15, 2025):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (May 15, 2025): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:26:33 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 22, 2025):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (May 22, 2025): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#945
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?