SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-17 13:42:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

OIDC Certificate issue - Certificate is Valid and Trusted by Host #896

New Issue
Closed
opened 2025-11-20 05:19:30 -05:00 by saavagebueno · 8 comments
saavagebueno commented 2025-11-20 05:19:30 -05:00
Owner
Copy Link

Originally created by @Sgt-Ogre on GitHub (May 15, 2024).

My management container fails to start with the following errors:

management-1  | 2024-05-15T16:58:55Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration

management-1  | Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration Get "https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority

I can curl the configuration file on the host just fine, i can navigate to the URL in a browser and the certificate is valid and trusted, i have installed the Lets Encrypt X1 and R3 certificates onto the host in the trust store.

Is there a way to get better errors? I have gone into Authentik and added my wildcard cert, tried with the self signed cert, and no cert and the error does not change.

Originally created by @Sgt-Ogre on GitHub (May 15, 2024). My management container fails to start with the following errors: ``` management-1 | 2024-05-15T16:58:55Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration management-1 | Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration Get "https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority ``` I can curl the configuration file on the host just fine, i can navigate to the URL in a browser and the certificate is valid and trusted, i have installed the Lets Encrypt X1 and R3 certificates onto the host in the trust store. Is there a way to get better errors? I have gone into Authentik and added my wildcard cert, tried with the self signed cert, and no cert and the error does not change.
saavagebueno added the waiting-feedbacktriage-needed labels 2025-11-20 05:19:30 -05:00
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@Helloworld-zyt commented on GitHub (Aug 12, 2024):

Same with me

@Helloworld-zyt commented on GitHub (Aug 12, 2024): Same with me
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Aug 12, 2024):

@Helloworld-zyt @Sgt-Ogre can you access the management container with docker compose exec -ti management /bin/bash and run the following commands:

apt install curl
curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration

if that returns a certificate error, try running:

apt update && apt install ca-certificates
curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration
@mlsmaycon commented on GitHub (Aug 12, 2024): @Helloworld-zyt @Sgt-Ogre can you access the management container with `docker compose exec -ti management /bin/bash` and run the following commands: ```shell apt install curl curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration ``` if that returns a certificate error, try running: ```shell apt update && apt install ca-certificates curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration ```
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@PeterWang-dev commented on GitHub (Aug 12, 2024):

@Helloworld-zyt @Sgt-Ogre can you access the management container with docker compose exec -ti management /bin/bash and run the following commands:

apt install curl
curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration

if that returns a certificate error, try running:

apt update && apt install ca-certificates
curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration

As container keep restarting, I cannot get into it.

@PeterWang-dev commented on GitHub (Aug 12, 2024): > @Helloworld-zyt @Sgt-Ogre can you access the management container with `docker compose exec -ti management /bin/bash` and run the following commands: > > ```shell > apt install curl > curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration > ``` > > if that returns a certificate error, try running: > > ```shell > apt update && apt install ca-certificates > curl -v https://IDPDOMAIN.com/application/o/netbird/.well-known/openid-configuration > ``` As container keep restarting, I cannot get into it.
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Aug 12, 2024):

you can try running a modified version of the management container with the latest ca-certificates:

FROM netbirdio/management:latest
RUN apt install -y ca-certificates

docker build -t netbirdio/management:local .

then you update the image in your docker-compose.yml and run docker compose up -d

@mlsmaycon commented on GitHub (Aug 12, 2024): you can try running a modified version of the management container with the latest ca-certificates: ```Dockerfile FROM netbirdio/management:latest RUN apt install -y ca-certificates ``` ``` docker build -t netbirdio/management:local . ``` then you update the image in your docker-compose.yml and run `docker compose up -d`
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@PeterWang-dev commented on GitHub (Aug 12, 2024):

you can try running a modified version of the management container with the latest ca-certificates:

FROM netbirdio/management:latest
RUN apt install -y ca-certificates

docker build -t netbirdio/management:local .

then you update the image in your docker-compose.yml and run docker compose up -d

I have located problem. That is, the authentik and netbird is in the same docker network. So when routing, <domain> just went through, not accessed the reverse proxy. So cert is missing with bare authentik https port.

However after bypassing this, I still cannot get everything work. Errors keep poping up, complaining Invalid token .

Is there any group (maybe Telegram) where experienced user could offer help?

@PeterWang-dev commented on GitHub (Aug 12, 2024): > you can try running a modified version of the management container with the latest ca-certificates: > > ```dockerfile > FROM netbirdio/management:latest > RUN apt install -y ca-certificates > ``` > > ``` > docker build -t netbirdio/management:local . > ``` > > then you update the image in your docker-compose.yml and run `docker compose up -d` I have located problem. That is, the authentik and netbird is in the same docker network. So when routing, `<domain>` just went through, not accessed the reverse proxy. So cert is missing with bare authentik https port. However after bypassing this, I still cannot get everything work. Errors keep poping up, complaining `Invalid token` . Is there any group (maybe Telegram) where experienced user could offer help?
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @Sgt-Ogre,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @Sgt-Ogre, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

@mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@ddesmond commented on GitHub (Oct 7, 2025):

I wish if we can revise and reopen this issue and provide feedback.

We have a certificate expiring in 10 days. I am already 3rd day in debugging this issue.

Nginx proxy manager is providing both authentik and netbird SSLs. Authentik is setup to be IDP.

I want to swap between the two, but here comes the error:

management-1  | 2025-10-07T04:42:00Z INFO [context: SYSTEM] management/cmd/management.go:157: loading OIDC configuration from the provided IDP configuration endpoint https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration
management-1  | Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration Get "https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority
management-1 exited with code 1 (restarting)

The old 2025 ssl cert which is expiring is * certificate issued by Sectigo. The new one is the same extended certificate from Sectigo.

If i have authentik on the old expiring cert there is no error, if i have enabled the new one, managment docker is just crashing and restarting.

Steps I have taken:

  • update netbird to latest (with the wasm fixes)
  • edit docker compose file and try with extra-hosts
  • rebuild the managmenet docker image for ca-certificates update

Can someone help me out with this?

Thanks a lot, LOVE NETBIRD ❤️

EDIT:
this was solved.
The certificates provided had no intermediate in the chain. Adding and or reissuing the certificates made the error go away.

@ddesmond commented on GitHub (Oct 7, 2025): I wish if we can revise and reopen this issue and provide feedback. We have a certificate expiring in 10 days. I am already 3rd day in debugging this issue. Nginx proxy manager is providing both authentik and netbird SSLs. Authentik is setup to be IDP. I want to swap between the two, but here comes the error: ``` management-1 | 2025-10-07T04:42:00Z INFO [context: SYSTEM] management/cmd/management.go:157: loading OIDC configuration from the provided IDP configuration endpoint https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration management-1 | Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration Get "https://blabla.blabla.com/application/o/netbird/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority management-1 exited with code 1 (restarting) ``` The old 2025 ssl cert which is expiring is * certificate issued by Sectigo. The new one is the same extended certificate from Sectigo. If i have authentik on the old expiring cert there is no error, if i have enabled the new one, managment docker is just crashing and restarting. Steps I have taken: - update netbird to latest (with the wasm fixes) - edit docker compose file and try with extra-hosts - rebuild the managmenet docker image for ca-certificates update Can someone help me out with this? Thanks a lot, LOVE NETBIRD ❤️ EDIT: this was solved. The certificates provided had no intermediate in the chain. Adding and or reissuing the certificates made the error go away.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#896
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?