18 replies

Coder OSS - code-server certificate issue

Hi all,

I've been stumped on this so I'm hoping maybe someone here has seen this before and has any ideas for how to approach solving this. The goal is to host code-server as a Coder workspace. When I try to open the code-server web view, I see the attached screen. It says "code-server is offline! x509: certificate signed by unknown authority." Here are some configuration details:

I'm running Coder OSS on RHEL 8 using Docker Compose. The docker-compose.yaml for the Coder service has the following changes:

    ports:
      - "443:443"
    environment:
      CODER_ADDRESS: "0.0.0.0:443"
      CODER_ACCESS_URL: "https://coder.mydomain.tld"
      CODER_TLS_ENABLE: true
      CODER_TLS_CERT_FILE: "/home/coder/cert/coder.mydomain.tld.cer"
      CODER_TLS_KEY_FILE: "/home/coder/cert/service.key"

    ports:
      - "443:443"
    environment:
      CODER_ADDRESS: "0.0.0.0:443"
      CODER_ACCESS_URL: "https://coder.mydomain.tld"
      CODER_TLS_ENABLE: true
      CODER_TLS_CERT_FILE: "/home/coder/cert/coder.mydomain.tld.cer"
      CODER_TLS_KEY_FILE: "/home/coder/cert/service.key"

coder.mydomain.tld.cer

coder.mydomain.tld.cer

is a web server certificate chain signed by my domain controller CA. Accessing

https://coder.mydomain.tld

https://coder.mydomain.tld

works on my devices (both via browser & cli) and the cert chain seems to be configured correctly. The docker host has had the domain CAs added to the trusted ca store.

I've set up code-server using the docker-code-server template. To get it to work, I made some modifications to the template's

main.tf

main.tf

in order to run a script that fetches the certs and adds them to the container's trusted store before downloading the coder agent (this was required to allow curl to securely fetch the agent from the coder service).

The code-server container logs show the following error:

2022-08-31 20:37:55.284 [DEBUG] <./peer/channel.go:277> (*Channel).closeWithError       datachannel closing with error  {"id": 3, "label": "tcp://coder.mydomain.tld:443"} ...
  "error": connection was closed:
               github.com/coder/coder/peer.init
                   /home/runner/work/coder/coder/peer/conn.go:28
             - EOF

2022-08-31 20:37:55.284 [DEBUG] <./peer/channel.go:277> (*Channel).closeWithError       datachannel closing with error  {"id": 3, "label": "tcp://coder.mydomain.tld:443"} ...
  "error": connection was closed:
               github.com/coder/coder/peer.init
                   /home/runner/work/coder/coder/peer/conn.go:28
             - EOF

Some research into this specific error led me to discover that Go looks for trusted authorities in a directory that is machine specific. I've added the binary (*.crt) certs to that folder on the code-server container, but I'm still getting this error.

If anyone has any thoughts, I'd greatly appreciate it!

Coder OSS - code-server certificate issue

    ports:
      - "443:443"
    environment:
      CODER_ADDRESS: "0.0.0.0:443"
      CODER_ACCESS_URL: "https://coder.mydomain.tld"
      CODER_TLS_ENABLE: true
      CODER_TLS_CERT_FILE: "/home/coder/cert/coder.mydomain.tld.cer"
      CODER_TLS_KEY_FILE: "/home/coder/cert/service.key"

    ports:
      - "443:443"
    environment:
      CODER_ADDRESS: "0.0.0.0:443"
      CODER_ACCESS_URL: "https://coder.mydomain.tld"
      CODER_TLS_ENABLE: true
      CODER_TLS_CERT_FILE: "/home/coder/cert/coder.mydomain.tld.cer"
      CODER_TLS_KEY_FILE: "/home/coder/cert/service.key"

coder.mydomain.tld.cer

coder.mydomain.tld.cer

is a web server certificate chain signed by my domain controller CA. Accessing

https://coder.mydomain.tld

https://coder.mydomain.tld

main.tf

main.tf

2022-08-31 20:37:55.284 [DEBUG] <./peer/channel.go:277> (*Channel).closeWithError       datachannel closing with error  {"id": 3, "label": "tcp://coder.mydomain.tld:443"} ...
  "error": connection was closed:
               github.com/coder/coder/peer.init
                   /home/runner/work/coder/coder/peer/conn.go:28
             - EOF

2022-08-31 20:37:55.284 [DEBUG] <./peer/channel.go:277> (*Channel).closeWithError       datachannel closing with error  {"id": 3, "label": "tcp://coder.mydomain.tld:443"} ...
  "error": connection was closed:
               github.com/coder/coder/peer.init
                   /home/runner/work/coder/coder/peer/conn.go:28
             - EOF

Coder OSS - code-server certificate issue

Coder OSS - code-server certificate issue

Continue the conversation

Coder.com

Similar Threads

Similar Threads

Continue the conversation

Coder.com

Similar Threads