[GH-ISSUE #386] Run mkcert inside the php:x-apache container gives SSL certificate problem: unable to get local issuer certificate #256

Closed
opened 2026-02-25 22:32:58 +03:00 by kerem · 6 comments
Owner

Originally created by @roland-d on GitHub (Jul 18, 2021).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/386

Hello,

Thank you for your work on this extension.

I have it all up and running fine on my local workstation running in Docker containers. The only issue I have is that when I run a cURL call for example from PHP to the local domain name, I get the error SSL certificate problem: unable to get local issuer certificate

I am running a Dockerfile using the php:7.4-apache image.

Now I understand that this happens because cURL cannot verify the certificate authority given this output:

*   Trying 127.0.0.1...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55dda87ecfb0)
* Connected to joomlacms.test (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* * SSL certificate problem: unable to get local issuer certificate
* Closing connection 0

Checking the CA Root, it shows that it is correct:

root@354ae379d24c:/var/www/html# mkcert -CAROOT
/etc/ssl/certs

Checking if it is installed, it is:

root@354ae379d24c:/var/www/html# mkcert -install
The local CA is already installed in the system trust store! 👍

Checking the certificate using openSSL this looks as follows:

root@354ae379d24c:/var/www/html# openssl s_client -connect joomlacms.test:443
CONNECTED(00000003)
depth=0 O = mkcert development certificate, OU = root@5d602fd702ee
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = mkcert development certificate, OU = root@5d602fd702ee
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:O = mkcert development certificate, OU = root@5d602fd702ee
   i:O = mkcert development CA, OU = root@5d602fd702ee, CN = mkcert root@5d602fd702ee
---
Server certificate
-----BEGIN CERTIFICATE-----
<REMOVED>
-----END CERTIFICATE-----
subject=O = mkcert development certificate, OU = root@5d602fd702ee

issuer=O = mkcert development CA, OU = root@5d602fd702ee, CN = mkcert root@5d602fd702ee

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1606 bytes and written 386 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: AD59F913DD7463CD1766F3D70557EC02D02CABF5A62D2023BC77AD7B5DF63FB3
    Session-ID-ctx: 
    Resumption PSK: A94F42966D28A83A761382CB7EB371599235ED48F14409F15EECCC09944D74A58487A943A8C323D2A9C448A4997D559D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 33 db 6f f1 f2 9b c7 82-03 1c f8 96 60 7e 76 0e   3.o.........`~v.
    0010 - a0 15 ce 55 0c 05 23 76-fd 03 64 fa 41 b3 90 eb   ...U..#v..d.A...
    0020 - 04 18 aa bd 88 4f 80 7d-ca 2e fe 6a 5c 46 4d e4   .....O.}...j\FM.
    0030 - 41 5f 7c 34 1b 2e df 11-87 1c 2a 8d 74 a0 68 70   A_|4......*.t.hp
    0040 - 94 65 c9 ca e7 51 36 09-72 19 a8 f5 98 27 50 89   .e...Q6.r....'P.
    0050 - 31 28 0a 75 1a 1a d5 1d-b9 eb 5f 6b 4a ec e7 f7   1(.u......_kJ...
    0060 - f0 06 2a 90 9f 09 e7 30-16 03 f5 9a 2f d4 9e 95   ..*....0..../...
    0070 - df 7c b8 e9 74 55 4a 93-2a bc fe 17 9c b0 e3 c3   .|..tUJ.*.......
    0080 - 1d e5 2f 21 16 cf 1f 6d-f8 19 7c 08 46 ec 4b bb   ../!...m..|.F.K.
    0090 - cf 93 26 de ad eb 00 53-6b b7 bd 71 cf e2 d7 b4   ..&....Sk..q....
    00a0 - cf cf 4e 6e c7 b1 ca 2e-9a 4f 92 71 f2 96 e8 84   ..Nn.....O.q....
    00b0 - 1e 16 af 4d 9d 51 e9 8f-80 9c 27 56 cb bf fb 2a   ...M.Q....'V...*
    00c0 - f7 dc 0a 5b 6b a0 65 0c-e2 86 fd 54 49 2f 7e ce   ...[k.e....TI/~.
    00d0 - 6a dd d7 bf 3c 8a f7 1d-8e ef 8d a7 f9 e8 fa 2c   j...<..........,
    00e0 - c8 8d 18 4c 30 e6 54 4f-fd 32 81 0f da c4 36 67   ...L0.TO.2....6g

    Start Time: 1626613775
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 2D9C388276FA1805A9C20933C6428DD979E93AFBABBF317F17A39C9E4E76C112
    Session-ID-ctx: 
    Resumption PSK: A00EE9BB0B800B29EC756A9B23B7E9913DA9EE8A479A3B51E2BB97421D32313B01AE06D93702EE497E8A3C727632AA04
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 33 db 6f f1 f2 9b c7 82-03 1c f8 96 60 7e 76 0e   3.o.........`~v.
    0010 - 27 a8 33 16 0c 26 77 ef-94 f4 62 fb 86 2a c0 34   '.3..&w...b..*.4
    0020 - fa c4 93 13 fd 03 66 a9-2e b6 91 54 f1 4f 65 74   ......f....T.Oet
    0030 - 64 42 c6 44 cd 7a 15 a3-7f bc 66 36 4f cf 7a 5a   dB.D.z....f6O.zZ
    0040 - 51 98 70 c5 cb ad de 4b-82 26 3e 49 a7 7c 73 ba   Q.p....K.&>I.|s.
    0050 - e9 00 48 e6 5b c6 54 07-9a 6d a6 a6 ce 4e 33 41   ..H.[.T..m...N3A
    0060 - bb 86 08 9c c1 52 af 7e-6f 2f 96 83 de 79 c3 33   .....R.~o/...y.3
    0070 - 61 25 af e9 4d 2c a1 30-42 3d 5b 73 a5 50 ea c7   a%..M,.0B=[s.P..
    0080 - a9 23 90 68 81 6e a9 ba-dc 15 83 bc 0f 77 d5 3e   .#.h.n.......w.>
    0090 - 99 3f 5e dd 89 25 62 b9-6e a7 07 cf f3 83 45 4a   .?^..%b.n.....EJ
    00a0 - 7c 23 16 13 19 20 38 42-ae 99 5c 3b 86 34 cd 9e   |#... 8B..\;.4..
    00b0 - d5 61 e0 55 df ab 74 4f-23 e5 44 f2 27 37 b5 f2   .a.U..tO#.D.'7..
    00c0 - fe d1 ed 9c 40 40 f2 ec-50 cd b4 60 de c5 11 1b   ....@@..P..`....
    00d0 - df b2 69 fa 57 43 78 92-80 55 b7 ca 34 e2 30 d2   ..i.WCx..U..4.0.
    00e0 - 24 9b 06 db 12 c4 65 f6-5f 35 7f 90 53 db c2 a3   $.....e._5..S...

    Start Time: 1626613775
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
closed

On my local machine I also have mkcert running with the same certificates from the Docker container and that works fine both in the browser and cURL:

*   Trying 127.0.0.1:443...
* Connected to joomlacms.test (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: O=mkcert development certificate; OU=root@5d602fd702ee
*  start date: Jul 18 10:57:34 2021 GMT
*  expire date: Oct 18 10:57:34 2023 GMT
*  subjectAltName: host "joomlacms.test" matched cert's "joomlacms.test"
*  issuer: O=mkcert development CA; OU=root@5d602fd702ee; CN=mkcert root@5d602fd702ee
*  SSL certificate verify ok.
> HEAD / HTTP/1.1
> Host: joomlacms.test
> User-Agent: curl/7.77.0

Is there anything I am missing? Could it be that the host OS is not supported?

Any insights are welcome.

Originally created by @roland-d on GitHub (Jul 18, 2021). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/386 Hello, Thank you for your work on this extension. I have it all up and running fine on my local workstation running in Docker containers. The only issue I have is that when I run a cURL call for example from PHP to the local domain name, I get the error `SSL certificate problem: unable to get local issuer certificate` I am running a Dockerfile using the `php:7.4-apache` image. Now I understand that this happens because cURL cannot verify the certificate authority given this output: ``` * Trying 127.0.0.1... * TCP_NODELAY set * Expire in 200 ms for 4 (transfer 0x55dda87ecfb0) * Connected to joomlacms.test (127.0.0.1) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS alert, unknown CA (560): * * SSL certificate problem: unable to get local issuer certificate * Closing connection 0 ``` Checking the CA Root, it shows that it is correct: ``` root@354ae379d24c:/var/www/html# mkcert -CAROOT /etc/ssl/certs ``` Checking if it is installed, it is: ``` root@354ae379d24c:/var/www/html# mkcert -install The local CA is already installed in the system trust store! 👍 ``` Checking the certificate using openSSL this looks as follows: ``` root@354ae379d24c:/var/www/html# openssl s_client -connect joomlacms.test:443 CONNECTED(00000003) depth=0 O = mkcert development certificate, OU = root@5d602fd702ee verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 O = mkcert development certificate, OU = root@5d602fd702ee verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:O = mkcert development certificate, OU = root@5d602fd702ee i:O = mkcert development CA, OU = root@5d602fd702ee, CN = mkcert root@5d602fd702ee --- Server certificate -----BEGIN CERTIFICATE----- <REMOVED> -----END CERTIFICATE----- subject=O = mkcert development certificate, OU = root@5d602fd702ee issuer=O = mkcert development CA, OU = root@5d602fd702ee, CN = mkcert root@5d602fd702ee --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 1606 bytes and written 386 bytes Verification error: unable to verify the first certificate --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 21 (unable to verify the first certificate) --- --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_AES_256_GCM_SHA384 Session-ID: AD59F913DD7463CD1766F3D70557EC02D02CABF5A62D2023BC77AD7B5DF63FB3 Session-ID-ctx: Resumption PSK: A94F42966D28A83A761382CB7EB371599235ED48F14409F15EECCC09944D74A58487A943A8C323D2A9C448A4997D559D PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 33 db 6f f1 f2 9b c7 82-03 1c f8 96 60 7e 76 0e 3.o.........`~v. 0010 - a0 15 ce 55 0c 05 23 76-fd 03 64 fa 41 b3 90 eb ...U..#v..d.A... 0020 - 04 18 aa bd 88 4f 80 7d-ca 2e fe 6a 5c 46 4d e4 .....O.}...j\FM. 0030 - 41 5f 7c 34 1b 2e df 11-87 1c 2a 8d 74 a0 68 70 A_|4......*.t.hp 0040 - 94 65 c9 ca e7 51 36 09-72 19 a8 f5 98 27 50 89 .e...Q6.r....'P. 0050 - 31 28 0a 75 1a 1a d5 1d-b9 eb 5f 6b 4a ec e7 f7 1(.u......_kJ... 0060 - f0 06 2a 90 9f 09 e7 30-16 03 f5 9a 2f d4 9e 95 ..*....0..../... 0070 - df 7c b8 e9 74 55 4a 93-2a bc fe 17 9c b0 e3 c3 .|..tUJ.*....... 0080 - 1d e5 2f 21 16 cf 1f 6d-f8 19 7c 08 46 ec 4b bb ../!...m..|.F.K. 0090 - cf 93 26 de ad eb 00 53-6b b7 bd 71 cf e2 d7 b4 ..&....Sk..q.... 00a0 - cf cf 4e 6e c7 b1 ca 2e-9a 4f 92 71 f2 96 e8 84 ..Nn.....O.q.... 00b0 - 1e 16 af 4d 9d 51 e9 8f-80 9c 27 56 cb bf fb 2a ...M.Q....'V...* 00c0 - f7 dc 0a 5b 6b a0 65 0c-e2 86 fd 54 49 2f 7e ce ...[k.e....TI/~. 00d0 - 6a dd d7 bf 3c 8a f7 1d-8e ef 8d a7 f9 e8 fa 2c j...<.........., 00e0 - c8 8d 18 4c 30 e6 54 4f-fd 32 81 0f da c4 36 67 ...L0.TO.2....6g Start Time: 1626613775 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) Extended master secret: no Max Early Data: 0 --- read R BLOCK --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_AES_256_GCM_SHA384 Session-ID: 2D9C388276FA1805A9C20933C6428DD979E93AFBABBF317F17A39C9E4E76C112 Session-ID-ctx: Resumption PSK: A00EE9BB0B800B29EC756A9B23B7E9913DA9EE8A479A3B51E2BB97421D32313B01AE06D93702EE497E8A3C727632AA04 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 33 db 6f f1 f2 9b c7 82-03 1c f8 96 60 7e 76 0e 3.o.........`~v. 0010 - 27 a8 33 16 0c 26 77 ef-94 f4 62 fb 86 2a c0 34 '.3..&w...b..*.4 0020 - fa c4 93 13 fd 03 66 a9-2e b6 91 54 f1 4f 65 74 ......f....T.Oet 0030 - 64 42 c6 44 cd 7a 15 a3-7f bc 66 36 4f cf 7a 5a dB.D.z....f6O.zZ 0040 - 51 98 70 c5 cb ad de 4b-82 26 3e 49 a7 7c 73 ba Q.p....K.&>I.|s. 0050 - e9 00 48 e6 5b c6 54 07-9a 6d a6 a6 ce 4e 33 41 ..H.[.T..m...N3A 0060 - bb 86 08 9c c1 52 af 7e-6f 2f 96 83 de 79 c3 33 .....R.~o/...y.3 0070 - 61 25 af e9 4d 2c a1 30-42 3d 5b 73 a5 50 ea c7 a%..M,.0B=[s.P.. 0080 - a9 23 90 68 81 6e a9 ba-dc 15 83 bc 0f 77 d5 3e .#.h.n.......w.> 0090 - 99 3f 5e dd 89 25 62 b9-6e a7 07 cf f3 83 45 4a .?^..%b.n.....EJ 00a0 - 7c 23 16 13 19 20 38 42-ae 99 5c 3b 86 34 cd 9e |#... 8B..\;.4.. 00b0 - d5 61 e0 55 df ab 74 4f-23 e5 44 f2 27 37 b5 f2 .a.U..tO#.D.'7.. 00c0 - fe d1 ed 9c 40 40 f2 ec-50 cd b4 60 de c5 11 1b ....@@..P..`.... 00d0 - df b2 69 fa 57 43 78 92-80 55 b7 ca 34 e2 30 d2 ..i.WCx..U..4.0. 00e0 - 24 9b 06 db 12 c4 65 f6-5f 35 7f 90 53 db c2 a3 $.....e._5..S... Start Time: 1626613775 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) Extended master secret: no Max Early Data: 0 --- read R BLOCK closed ``` On my local machine I also have `mkcert` running with the same certificates from the Docker container and that works fine both in the browser and cURL: ``` * Trying 127.0.0.1:443... * Connected to joomlacms.test (127.0.0.1) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: none * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: O=mkcert development certificate; OU=root@5d602fd702ee * start date: Jul 18 10:57:34 2021 GMT * expire date: Oct 18 10:57:34 2023 GMT * subjectAltName: host "joomlacms.test" matched cert's "joomlacms.test" * issuer: O=mkcert development CA; OU=root@5d602fd702ee; CN=mkcert root@5d602fd702ee * SSL certificate verify ok. > HEAD / HTTP/1.1 > Host: joomlacms.test > User-Agent: curl/7.77.0 ``` Is there anything I am missing? Could it be that the host OS is not supported? Any insights are welcome.
kerem closed this issue 2026-02-25 22:32:58 +03:00
Author
Owner

@chombe commented on GitHub (Aug 18, 2021):

@roland-d did you manage to find solution for this?
I'm stuck with the same issue only using nginx image.

Thanks in advance

<!-- gh-comment-id:901425748 --> @chombe commented on GitHub (Aug 18, 2021): @roland-d did you manage to find solution for this? I'm stuck with the same issue only using nginx image. Thanks in advance
Author
Owner

@roland-d commented on GitHub (Aug 19, 2021):

Hello, I have not yet found the time to build my own image yet. So i am still having the issue as well.

<!-- gh-comment-id:901675350 --> @roland-d commented on GitHub (Aug 19, 2021): Hello, I have not yet found the time to build my own image yet. So i am still having the issue as well.
Author
Owner

@roland-d commented on GitHub (Feb 15, 2022):

I have resolved this using the Cloudflare SSL Docker container.

<!-- gh-comment-id:1040743625 --> @roland-d commented on GitHub (Feb 15, 2022): I have resolved this using the Cloudflare SSL Docker container.
Author
Owner

@csuriano23 commented on GitHub (Sep 7, 2022):

@roland-d please could you provide details on how you solved this? I can't find a way the make the docker container recognize the CA installed in the local machine

<!-- gh-comment-id:1239216965 --> @csuriano23 commented on GitHub (Sep 7, 2022): @roland-d please could you provide details on how you solved this? I can't find a way the make the docker container recognize the CA installed in the local machine
Author
Owner

@roland-d commented on GitHub (Sep 20, 2022):

@csuriano23 You need to get your generated CA into your docker machine. Remember a container knows only what is available on the inside of the container not what is on your local machine. I have not yet made the step to make my own generated CA available inside the docker container. It works when I browse from my local machine.

I used this project as reference for setting up the CF SSL: https://github.com/simplesamlphp/docker-simplesamlphp

Unfortunately I cannot help you further.

<!-- gh-comment-id:1252767510 --> @roland-d commented on GitHub (Sep 20, 2022): @csuriano23 You need to get your generated CA into your docker machine. Remember a container knows only what is available on the inside of the container not what is on your local machine. I have not yet made the step to make my own generated CA available inside the docker container. It works when I browse from my local machine. I used this project as reference for setting up the CF SSL: https://github.com/simplesamlphp/docker-simplesamlphp Unfortunately I cannot help you further.
Author
Owner

@csuriano23 commented on GitHub (Sep 21, 2022):

Thank you @roland-d . I successfully solved my issue by copying and installing the cert on the docker container

<!-- gh-comment-id:1253372727 --> @csuriano23 commented on GitHub (Sep 21, 2022): Thank you @roland-d . I successfully solved my issue by copying and installing the cert on the docker container
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/mkcert#256
No description provided.