ssl - Kong API 网关 SSL/TLS 证书

Question

我在 Kong API 网关上遇到了 SSL/TLS 终止问题。使用 curl 和 Insomnia 的 HTTPS 请求得到了 的响应SSL 证书问题:无法获取本地颁发者证书 .
证书有效且由知名颁发者颁发，因此 CA 证书已在客户端已知 CA 列表中。
在浏览器 HTTPS 请求中工作正常。
我正在使用 香港版 2.7.1
docker-compose.yaml 以下一种方式配置:

  kong:
    image: kong:2.7.1
    container_name: kong-api-gw
    restart: always
    networks:
      kong-net:
        ipv4_address: 172.16.1.11
    volumes:
      - kong-volume:/etc/kong
      - kong-volume-conf:/usr/local/kong
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_DATABASE: kong
      KONG_PG_USER: ${KONG_PG_USER}
      KONG_PG_PASSWORD: ${KONG_PG_PASSWORD}
      KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
      KONG_ADMIN_LISTEN: 0.0.0.0:8001, 0.0.0.0:8444 ssl
      KONG_SSL: "on"
      KONG_SSL_CERT: /etc/kong/ssl/kong.crt
      KONG_SSL_CERT_KEY: /etc/kong/ssl/kong.key
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG:  /dev/stdout
    depends_on:
      - kong-database
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 10s
      timeout: 10s
      retries: 10
    ports:
      - "8000:8000"
      - "8001:8001"
      - "8443:8443"
      - "8444:8444"
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: "4000M"
    logging:
      driver: "json-file"
      options:
          max-file: "3"
          max-size: "10M"

证书是使用 Admin API 和 Konga UI 添加的，我尝试了 pem 和 crt，它们都是。

curl -X POST http://127.0.0.1:8001/certificates -H 'Content-Type: multipart/form-data' -F cert=@./kong.pem -F key=@./kong.key -F snis[]=example.com

在 docker 容器中，我将 mycert.crt 和 mycert.key 放入/etc/kong/ssl/，但没有任何帮助，日志中也没有错误。
GET 请求对 https://example.com:8444/certificates 的响应(在 Insomnia 中禁用 SSL 验证时)

{
    "data": [
        {
            "key_alt": null,
            "created_at": 1650871124,
            "cert_alt": null,
            "key": "-----BEGIN RSA PRIVATE KEY-----\cert-key-example\n-----END RSA PRIVATE KEY-----",
            "id": "7ebdca61-4598-4e17-bdf8-2239c41ce09b",
            "tags": null,
            "snis": [
                "example.com"
            ],
            "cert": "-----BEGIN CERTIFICATE-----\cert-example\n-----END CERTIFICATE-----"
        }
    ],
    "next": null
}

curl 示例

curl -i -v https://example.com:8443/api
*   Trying ip:8443...
* TCP_NODELAY set
* Connected to example.com (ip) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Answer 1

这不是错误，我想通了，Kong 需要 ca-bundle 证书而不仅仅是 crt。所以你需要结合根证书和中间证书。这些文件与您的服务器证书(专门为您的域颁发)一起完成了 SSL 信任链。最后，我只是使用 Kong Admin API 使用 Konga Web UI 或 POST 请求上传证书，例如:

curl -X POST \
  http://example.com:8001/certificates \
  -H 'Content-Type: multipart/form-data' \
  -F cert=@./kong.ca-bundle \
  -F key=@./kong.key \
  -F snis[]=example.com