Issue Installing in Docker

[goug76]

So for the last 2 days I have been trying to get this to work in Docker or anything in that matter. The install seems to work fine, but when I get to the test part it fails. My Docker environment is a little different, but everything is stored in a Docker folder and all of my binds are kept in folder call appdata within the docker folder. I have watched about a half dozen or so videos, to include Smallsteps, but mainly been following your instructions here.

Steps I've taken

1. First I install the step-cli for Ubuntu
2. I then Pull the image docker pull smallstep/step-ca
3. Then run the init process with and choose a standalone server
   docker run -it -v /home/goug76/docker/appdata/step:/home/step smallstep/step-ca step ca init

After following all the steps I get confirmation everything worked

4. Now the next part doesn't seem to work so I manually create a password file and paste in my password.
5. Next I use Docker Compose to run my container

services:
  step-ca:
    container_name: step-ca
    image: smallstep/step-ca
    restart: unless-stopped
    ports:
      - 8443:8443
    environment:
      - TZ=$TZ
    volumes:
      - $DOCKERDIR/appdata/step:/home/step

As you can see it's very basic just to get it up and running. I'm using Portainer to view the logs and VSCode to modify any the files.
6. Now it's time to install the certs on the localhost
CA_FINGERPRINT=$(docker run -v /home/goug76/docker/appdata/step:/home/step smallstep/step-ca step certificate fingerprint /home/step/certs/root_ca.crt)
step ca bootstrap --ca-url https://localhost:8443 --fingerprint $CA_FINGERPRINT
That seems to work as I see the same output as the dock says

But when I try to test with curl https://localhost:8443/health I get the following error.

I have even tried using my DNS name curl https://ca.goug.local:8443/health I get the same error.
When I look at the logs on Portainer I see this
2024/05/17 16:57:39 /usr/local/go/src/net/http/server.go:3411: http: TLS handshake error from 172.18.0.1:45996: local error: tls: bad record MAC

Also shortly after that Portainer shows the container as Unhealthy.

What am I doing wrong here, I followed the instructions to a T and nothing seems to work. I have even tried entering the exact same data as in the instructions, but it fails when trying to install the cert.

I'm on Ubuntu 22.04.3 I believe or which ever is the latest. Docker and Docker Compose are all the latest versions. This was a fresh install and I disabled the firewall.

Any help you can provide me would be greatly appreciated. Thank you in advance.

[goug76]

So I think I have it figured out. While that bootloader is supposed to put the certificate in the trusted store, it didn't. After copying the certificate to the location.
sudo cp appdata/step/certs/root_ca.crt /usr/local/share/ca-certificates/
Then update the certificates sudo update-ca-certificates.
I also had to add this to the end of my compose file which seem to do the trick from my main device.

    extra_hosts:
      - 'ca.goug.local:127.0.0.1'

So the full Compose file looks like this:

services:
  step-ca:
    container_name: step-ca
    image: smallstep/step-ca
    restart: unless-stopped
    ports:
      - 8443:8443
    environment:
      - TZ=$TZ
    volumes:
      - $DOCKERDIR/appdata/step:/home/step
    extra_hosts:
      - 'ca.goug.local:127.0.0.1'

I will try this on my original device and if I can get to work I will close this out.

[goug76]

I just got this working on my Raspberry Pi, following the same instructions. I will update my documentation and hopefully this will help someone having the same issue.

Now let's play and see what this can do!

[goug76]

I noticed in another video that this command step ca bootstrap --ca-url https://localhost:8443 --fingerprint $CA_FINGERPRINT is missing a parameter --install which does install it in the certificate store.