starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-26 08:26:03 +03:00

[GH-ISSUE #467] Docker image is missing the new Lets Encrypt intermediate root certificates #299

New issue

Closed

opened 2026-03-02 11:48:36 +03:00 by kerem · 5 comments

kerem commented

2026-03-02 11:48:36 +03:00

Owner

Originally created by @BertanAygun on GitHub (Oct 4, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/467

Opening a new issue, forking #407 since I initially thought it was the same but mine is different it looks like.

I need to set "NEXTAUTH_URL" to a reverse proxied full domain name using HSTS with a Lets Encrypt certificate, however this scenario fails because the app can't query https://hoarder..net/api/auth/providers. The certificate is valid in Edge/Chrome etc since I can visit the website just fine (but only credentials provider is enabled due to this error) and browser shows that certificate is valid.

In the container console, I used curl to try accessing that site and got the same error, after a bit reading it looks like this is caused by me having a newer LetsEncrypt certificate using an updated chain. The ISGR X1 root certificate is under /etc/ssl/certs but not the R10, R5 ones. Curl starts working if I download R10.pem and pass it along as an option.

Originally created by @BertanAygun on GitHub (Oct 4, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/467 Opening a new issue, forking #407 since I initially thought it was the same but mine is different it looks like. I need to set "NEXTAUTH_URL" to a reverse proxied full domain name using HSTS with a Lets Encrypt certificate, however this scenario fails because the app can't query https://hoarder.<domain>.net/api/auth/providers. The certificate is valid in Edge/Chrome etc since I can visit the website just fine (but only credentials provider is enabled due to this error) and browser shows that certificate is valid. In the container console, I used curl to try accessing that site and got the same error, after a bit reading it looks like this is caused by me having a newer LetsEncrypt certificate using an updated chain. The ISGR X1 root certificate is under /etc/ssl/certs but not the R10, R5 ones. Curl starts working if I download R10.pem and pass it along as an option.

kerem

2026-03-02 11:48:36 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-02 11:48:37 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Oct 4, 2024):

@BertanAygun do you have a URL that I can test against?

@MohamedBassem commented on GitHub (Oct 4, 2024): @BertanAygun do you have a URL that I can test against?

kerem commented

2026-03-02 11:48:37 +03:00

Author

Owner

@kamtschatka commented on GitHub (Oct 5, 2024):

If you can join discord and let me know your URL via PM, we can try it out and see if we can fix it. (or you open a PR yourself, If you have the knowledge to tackle that yourself)

@kamtschatka commented on GitHub (Oct 5, 2024): If you can join discord and let me know your URL via PM, we can try it out and see if we can fix it. (or you open a PR yourself, If you have the knowledge to tackle that yourself)

kerem commented

2026-03-02 11:48:37 +03:00

Author

Owner

@anselor commented on GitHub (Oct 6, 2024):

I just ran into a similar issue using self-signed certs hosted by a local CA in my home LAN.

Assuming your docker host has the proper certs registered, you can map in your host's cert store into the container in the compose file:

    volumes:
      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro

Then add this environment variable to tell node to use it:

  NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

See: https://github.com/nextauthjs/next-auth/issues/3580

@anselor commented on GitHub (Oct 6, 2024): I just ran into a similar issue using self-signed certs hosted by a local CA in my home LAN. Assuming your docker host has the proper certs registered, you can map in your host's cert store into the container in the compose file: ``` volumes: - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro ``` Then add this environment variable to tell node to use it: ``` NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt ``` See: https://github.com/nextauthjs/next-auth/issues/3580

kerem commented

2026-03-02 11:48:37 +03:00

Author

Owner

@BertanAygun commented on GitHub (Oct 8, 2024):

@anselor Thanks for the advice this worked nicely. I have also started encountering this issue in several other containers too.

Looks like the new LetsEncrypt certificates haven't fully propagated yet.

@BertanAygun commented on GitHub (Oct 8, 2024): @anselor Thanks for the advice this worked nicely. I have also started encountering this issue in several other containers too. Looks like the new LetsEncrypt certificates haven't fully propagated yet.

kerem commented

2026-03-02 11:48:38 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Feb 16, 2025):

Given that there isn't a lot of people hitting this, I'll consider this as no longer an issue

@MohamedBassem commented on GitHub (Feb 16, 2025): Given that there isn't a lot of people hitting this, I'll consider this as no longer an issue

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#299

No description provided.

Rows
Columns