Re: Hosting gitea with httpd and relayd: git and curl return "SSL certificate problem: unable to get local issuer certificate"

[Am Jam]

On Sat, Oct 26, 2024 at 11:32 PM Anthony J. Bentley <anth...@anjbe.name>
wrote:

> relayd will pick up src.domain.io.crt, which is probably not a
> full chain certificate. It won't pick up src.domain.io.fullchain.pem,
> which is (probably) a full chain cert.
>
> As I can't see your acme-client.conf or your previous httpd.conf that
> worked without TLS errors, I'm guessing your old httpd.conf specified
> src.domain.io.fullchain.pem as its certificate instead of
> src.domain.io.crt, which is why it worked, and your acme-client.conf
> probably only writes a full chain to src.domain.io.fullchain.pem.
>

Anthony, thank you for your generous time troubleshooting with me here.
Your assumptions are correct; however, the obvious solution of renaming the
fullchain certificate file doesn't appear to work.

# acme-client.conf
 domain src.domain.io {
        domain key "/etc/ssl/private/src.domain.io.key"
        domain certificate "/etc/ssl/src.domain.io.crt"
        domain full chain certificate "/etc/ssl/src.domain.io.fullchain.pem"
        sign with letsencrypt
}

# OLD httpd.conf
server "src.domain.io" {
        listen on * tls port 443

        tls {
                certificate "/etc/ssl/src.domain.io.fullchain.pem"
                key "/etc/ssl/private/src.domain.io.key"
        }

        location "/.well-known/acme-challenge/*" {
                root "/acme"
                request strip 2
        }

        location "/*" {
                fastcgi socket tcp 127.0.0.1 3000
        }
}

server "src.domain.io" {
        listen on * port 80

        location "/.well-known/acme-challenge/*" {
                root "/acme"
                request strip 2
        }
        location * {
                block return 302 "https://$HTTP_HOST$REQUEST_URI";
        }
}


That httpd.conf was my old httpd-only-no-relayd working config.
Now that I have relayd up and running, reading your replies made me think I
could do the following:

# cd /etc/ssl
# mv src.domain.io.crt src.domain.io.notfullchain.crt
# mv src.domain.io.fullchain.pem src.domain.io.crt

This does not appear to disrupt the browser pointing to src.domain.io.
However, "git clone" and "curl" still return the error: SSL certificate
problem: unable to get local issuer certificate.


Many Thanks.