How to use the certificate authority created by mkcert inside a docker container

[RemyCampanals]

First of all, thanks a lot to the mkcert team, always a pleasure using this tools for years, always working like a charm ! 👌

But for the first time, i'm making something more complex than creating the CA and the certificates, putting them in my nginx container, accessing the project from the browser and that's it. I don't know if it's maybe more a docker/nginx problem than a mkcert problem, but since i'm using mkcert for this, maybe i can have some hints here so here we go ! 🚀

PS: I'm on MacOS using Docker For Desktop, and i'm french so sorry in advance if my english is not perfect

I'm using the latest version of docker-compose, i have 4-5 websites sharing the same two docker containers :

• nginx
• php-fpm

I made a batch file in order to create the CA and all the certificates domains i need :

mkcert -install
mkcert -key-file docker/nginx/config/certs/domain.dev/domain.key -cert-file docker/nginx/config/certs/domain.dev/domain.crt "*.domain.dev"

I used a wildcard in order to use all the subdomain i need :

• api.domain.dev
• web1.domain.dev
• web2.domain.dev
• etc...

In my nginx configuration, i have created as many server configuration i needed, for exemple for api.domain.dev :

server {
    server_name api.domain.dev;
    listen 443 ssl http2;

    ssl_certificate /etc/ssl/certs/domain.dev/domain.crt;
    ssl_certificate_key /etc/ssl/certs/domain.dev/domain.key;

    location ~ ^/index\.php(/|$) {
        fastcgi_pass domain_php_fpm:9000;
        [all fastcgi_params needed to work]
    }
}

server {
    server_name api.domain.dev;
    listen 80;
    return 301 https://$host$request_uri;
}

i repeat this scheme for all my domains, with the Dockerfile files needed to COPY the certificates from the host to the container

And right now, everything works, if i go to api.domain.dev in my browser, or making a POSTMAN request, everything is working perfectly using https protocol, my connexion is secured in a "localhost" environement.

But then :

• I need for the project under the api.domain.dev to make a Guzzle request to... let's say... web1.domain.dev and it's not working.
• For my understanding it's not working because the php-fpm who make the Guzzle php instruction don't know about the hostname web1.domain.dev, it's only working on the host side because i changed my /etc/hosts file
• So i change my docker-compose.yml like this :

nginx:
      container_name: domain_nginx
      extra_hosts:
            - "api.domain.dev web1.domain.dev web2.domain.dev"
php-fpm:
      container_name: domain_php_fpm
      extra_hosts:
            - "api.domain.dev web1.domain.dev web2.domain.dev"

That way, it seems to create a gateway inside the hosts file in the container in order to be able to connect to the nginx container.
But only if i make a Guzzle request to http://web1.domain.dev and not https://web1.domain.dev. When i tried i have the following error :

SSL certificate problem: unable to get local issuer certificate

So with mkcert i tried to retrieve the rootCA.pem created when using mkcert -install in order to use the same certificate authority as my MacOS hosts. But my understanding of all this ssl certificates thingy is beyond my understanding.

What i tried is using another batch script with :

mkcert -install
cp "$$(mkcert -CAROOT)/rootCA.pem" docker/nginx/config/certs/domain.dev/rootCA.pem

Then COPY the rootCA.pem in my Dockerfile configuration and i added the following lines in all my nginx server configuration under the ssl_certificate_key line :

ssl_client_certificate /etc/ssl/certs/rootCA.pem;
ssl_verify_client on;

When i'm doing i break all my workflow (even in a browser or postman request) and i always have the following nginx error :

<center>
        <h1>400 Bad Request</h1>
    </center>
    <center>No required SSL certificate was sent</center>
    <hr>
    <center>nginx/1.25.0</center>

What do i do wrong ?

Thanks in advance 🙏
And sorry if it's not the place to ask something like this

[vismutx]

I found a solution.

1. you should install mkcert on machine where you use browser to open your pages
2. on that machine you should generate pem files for you domains
3. copy this pem files to folder, that you are using for certs in nginx
   example
   ssl_certificate /etc/nginx/certs/devcert.pem;
   ssl_certificate_key /etc/nginx/certs/devcert-key.pem;
   this folder
   In my dev environment it was a virtual machine with server for my project.

Now all should work, I still see warning in the browser, but no alert when opening site and my websocets now accept this certs and work fine.

4. Don't know if it is affect something, I also copied generated certs to my mkcert -CAROOT folder. Didn't try to delete and test it. It is working and I don't touch it.

[rashadatjou]

Thank you for this!