Hello,
I have exactly the same problem with a fresh install of open-balena
Here is what I have found
On Balena OS:
root@4da4116:~# whoami
root
root@4da4116:~# ls /etc/ssl/certs/balenaRootCA.pem
/etc/ssl/certs/balenaRootCA.pem
root@4da4116:~# curl https://api.sanitized.domain/ping
OK
Everything is okay, connection is possible and cert is setup
In the Supervisor container:
balena exec -it f9aa8b9b65a2 /bin/sh
/usr/src/app # whoami
root
/usr/src/app # ls /usr/local/share/ca-certificates/balenaRootCA.crt
ls: /usr/local/share/ca-certificates/balenaRootCA.crt: No such file or directory
/usr/src/app # ls /etc/ssl/certs/balenaRootCA.pem
ls: /etc/ssl/certs/balenaRootCA.pem: No such file or directory
/usr/src/app # curl https://api.sanitized.domain/ping
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned
The environment of Supervisor
/usr/src/app # env
BOOT_MOUNTPOINT=/mnt/boot
CONFIG_MOUNT_POINT=/boot/config.json
DEFAULT_MIXPANEL_TOKEN=bananasbananas
DELTA_ENDPOINT=https://delta.sanitized.domain
DOCKER_ROOT=/mnt/root/var/lib/docker
DOCKER_SOCKET=/var/run/balena-engine.sock
HOME=/root
HOSTNAME=4da4116
LED_FILE=/sys/class/leds/led0/brightness
LISTEN_PORT=48484
MIXPANEL_TOKEN=__unused__
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/usr/src/app
SHLVL=1
SUPERVISOR_CONTAINER_ID=f9aa8b9b65a2d03ea00eb997f41c1bb4c099ee313353224f5f7ba02a74ce8b73
SUPERVISOR_IMAGE=balena/aarch64-supervisor:v12.2.11
TERM=xterm
And to finish, it seems that the entry.sh should do the following
if [ -n "${BALENA_ROOT_CA}" ]; then
if [ ! -e '/etc/ssl/certs/balenaRootCA.pem' ]; then
echo "${BALENA_ROOT_CA}" > /etc/ssl/certs/balenaRootCA.pem
# Include the balenaRootCA in the system store for services like Docker
mkdir -p /usr/local/share/ca-certificates
echo "${BALENA_ROOT_CA}" > /usr/local/share/ca-certificates/balenaRootCA.crt
update-ca-certificates
fi
fi
but sadly, the environment variable BALENA_ROOT_CA does not exists
echo ${BALENA_ROOT_CA}
nothing
So at startup, no certificates are added
I can confirm that my config.json is mounted and is valid and the variable balenaRootCa is correct
So the real question / bug here is:
How do we take cert from config.json and setup in $BALENA_ROOT_CA variable so that the entrypoint setup the certificate?
