Go API deployed on GKE throws SSL Error: Unable to verify the first certificate . Am I missing something?

Question

以下是我的 Kubernetes 配置。当客户端禁用 SSL 验证或使用 HTTP 而不是 HTTPS 时，使用此配置部署的 API 会按预期工作。但是在启用时，它会抛出 SSL Error: Unable to verify the first certificate。 SSL 证书文件作为 Kubernetes 机密添加，API 在端口 8080 上公开。

---
apiVersion: "v1"
kind: "ConfigMap"
metadata:
  name: "test-config"
  namespace: "default"
  labels:
    app: "test"
data:
  ENV: "DEV"
---
apiVersion: "apps/v1"
kind: "Deployment"
metadata:
  name: "test"
  namespace: "default"
  labels:
    app: "test"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: "test"
  template:
    metadata:
      labels:
        app: "test"
    spec:
      containers:
        - name: "test"
          image: "gcr.io/test-project/test:latest"
          env:
            - name: "ENV"
              valueFrom:
                configMapKeyRef:
                  key: "ENV"
                  name: "test-config"
---
apiVersion: "extensions/v1beta1"
kind: "Ingress"
metadata:
  name: "test-ingress"
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "test-static-ip"
  labels:
    app: "test"
spec:
  tls:
  - hosts:
      - "test.myhost.com"
    secretName: "test-ssl-certificate"
  backend:
    serviceName: "test-service-nodeport"
    servicePort: 8080
  rules:
  - host: "test.myhost.com"
    http:
      paths:
      - path: "/*"
        backend:
          serviceName: "test-service-nodeport"
          servicePort: 8080
---
kind: "Service"
apiVersion: "v1"
metadata:
  name: "test-service-nodeport"
spec:
  selector:
    app: "test"
  ports:
    - protocol: "TCP"
      port: 8080
      targetPort: 8080
  type: "NodePort"

转到服务器代码

http.HandleFunc("/hello", HelloServer)
err := http.ListenAndServeTLS(":8080", "server.crt", "server.key", nil)
if err != nil {
    log.Fatal("ListenAndServe: ", err)
}

Answer 1

造成这种情况的一个潜在原因可能是中间证书未正确安装在服务器上，从而导致证书链中断。即使它在您的浏览器中工作，它也可能不包括缓存空客户端验证所需的链中的所有 public 证书。以下是一些初步的故障排除步骤：

验证您的证书链是否完整[https://certificatechain.io/ ]

验证您的服务器配置 [https://www.ssllabs.com/ssltest/ or https://www.sslshopper.com/ssl-checker.html]

查找此错误：此服务器的证书链不完整。
还有这个：连锁问题.........不完整

如果您遇到这些问题，则意味着您要连接的 Web 服务器配置错误，并且在它发送给您的证书链中遗漏了中间证书。您的服务器不仅需要为您的域提供证书，还需要提供中间证书。

中间证书应与服务器证书一起安装在服务器上。根证书嵌入到软件应用程序、浏览器和操作系统中。提供证书的应用程序必须发送完整的链，这意味着服务器证书本身和所有中间体。

参考 and combine the server certificate and intermediate certificate into a chained certificate获取信息。

Go API deployed on GKE throws SSL Error: Unable to verify the first certificate . Am I missing something?

Go API deployed on GKE throws SSL Error: Unable to verify the first certificate . Am I missing something?

go

kubernetes

google-kubernetes-engine