HTTPS Monitor Down with Self-Signed Cert #1380

EricEngardio · 2022-03-16T18:00:57Z

⚠️ Please verify that this bug has NOT been raised before.

I checked and didn't find similar issue

🛡️ Security Policy

I agree to have read this project Security Policy

📝 Describe your problem

Hey guys,

I know slightly similar questions have been answered before but I can't find an answer to my exact question.

I'm using HTTPS (keyword) monitors that are failing when connecting to sites that use self-signed certs (stay with me) and i've been trying to add the CA cert to multiple locations with no luck. I've seen it said before that you have to use the full chain on the web site but that's not possible for us for other sysadmin policy reasons.

I've tried:

adding the CA cert to /usr/local/ca-certificates and running update-ca-certificates (used crt format per Ubuntu's docs)
adding a system-wide environment variable of NODE_EXTRA_CA_CERTS=/cert/path/cert.pem to expand node's CA repository
adding a system-wide environment variable of NODE_TLS_REJECT_UNAUTHORIZED='0' to tell node processes to not care about certs it can't validate (not ideal but figured i'd try)

I feel like this should be possible unless the code causes a conflict with how node's docs explain how things should work. Can someone please verify if there's a way around this or if we absolutely have to use full-chain certs?

Thanks!

🐻 Uptime-Kuma Version

1.12.1

💻 Operating System and Arch

Ubuntu 20.04

🌐 Browser

Google Chrome 99.0.4844.51

🐋 Docker Version

No response

🟩 NodeJS Version

14.19.0

louislam · 2022-03-17T10:47:21Z

You could try "Ignore TLS/SSL error for HTTPS websites".

EricEngardio · 2022-03-28T17:48:27Z

Thanks for the quick response, Louis! Sorry, I sent this response like two weeks ago via email but I guess it didn't post here

Yes, that does work to make things go green but we’d rather just be able to load our CA cert in for the monitors to check with since we have it available and not have to do a workaround. Is that possible?

EricEngardio · 2022-03-29T16:55:59Z

@louislam I figured it out for the PM2 version of the install! It requires a couple of things and then the Uptime Kuma monitors will use any CA certificate you want to validate your HTTPS endpoints:

copy your CA files somewhere on the system in PEM format
edit the ecosystem.config.js file in the Uptime Kuma directory (could be anywhere but this is convenient) and include the following:

module.exports = {
apps: [{
name: "uptime-kuma",
script: "./server/server.js",
env_production: {
NODE_ENV: "production",
NODE_EXTRA_CA_CERTS: "/cert/path/CAcert.pem"
}
}]
}
3. When you run the app from PM2, you need to specify the ecosystem file you're using and the env variable:

sudo pm2 start /UPTIMEKUMA-DIRECTORY/ecosystem.config.js --env production --name uptime-kuma

With the Docker version you should be able to define those environment variables in the Docker compose file but I haven't messed with that, just the PM2 version

mmguero · 2022-04-01T20:21:58Z

@EricEngardio thanks for this workaround. Setting the NODE_EXTRA_CA_CERTS variable in my docker-compose.yml helped me settle this in my environment.

Kampfmoehre · 2022-04-26T08:04:19Z

For anyone struggling with setting up custom root CA in Kubernetes, we got it working with the following setup:

create a config map (for example ds-root-ca) with a key ds-root-ca.pem and add the Root CA certificate in PEM form (beginning with -----BEGIN CERTIFICATE-----) as value
mount the config map to the Kuma container for example with the following yaml

spec:
  template:
    spec:
      containers:
        - env:
            - name: NODE_EXTRA_CA_CERTS
              value: /etc/ds/cert/ds-root-ca.pem
          image: louislam/uptime-kuma:1.15.0-alpine
          name: kuma
          volumeMounts:
            - mountPath: /etc/ds/cert/ds-root-ca.pem
              name: ds-root-ca
              readOnly: true
              subPath: ds-root-ca.pem
      volumes:
        - configMap:
            defaultMode: 420
            name: ds-root-ca
            optional: true
          name: ds-root-ca

add the NODE_EXTRA_CA_CERTS environment variable that points to the root CA file

Voila, it now works.

Note: We used the full chain certificate for that.

EricEngardio · 2022-10-11T08:46:13Z

Thanks for the quick response, Louis! Yes, that does work to make things go green but we’d rather just be able to load our CA cert in for the monitors to check with since we have it available and not have to do a workaround. Is that possible? *Eric Engardio* Senior Systems Administrator 586-817-3537 <(586)%20817-3537> cell ***@***.*** email *From:* Louis Lam ***@***.***> *Sent:* Thursday, March 17, 2022 6:48 AM *To:* louislam/uptime-kuma ***@***.***> *Cc:* EricEngardio ***@***.***>; Author < ***@***.***> *Subject:* Re: [louislam/uptime-kuma] HTTPS Monitor Down with Self-Signed Cert (Issue #1380) You could try "Ignore TLS/SSL error for HTTPS websites". [image: image] <https://user-images.githubusercontent.com/1336778/158793029-0ea5b3ad-f36c-4b3b-b5f7-172b1ef760e6.png> — Reply to this email directly, view it on GitHub <#1380 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AWBOIYJOELZYIXWBNA6LR3TVAMEUJANCNFSM5Q4TZXVQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: < ***@***.***>

d3xt3r01 · 2023-02-10T11:37:33Z

+1. When using a local CA (like smallstepca) the procedure when using kuma in a container is a little bit cumbersome.
The container should always check for a specific location ( which we could use as a volume ) and always get the certs there and run update-ca-certificates.

jslegers73 · 2023-04-29T11:22:47Z

I have also tried this option but for me it still give a "self signed certificate in certificate chain" error. I'm running it also on docker. This is my compose part

uptime-kuma:
image: louislam/uptime-kuma:latest
container_name: Uptime-Kuma
restart: always
hostname: uptime-kuma
ports:
- '3001:3001'
environment:
NODE_EXTRA_CA_CERTS: '/home/pi/certs/ca.pem'
volumes:
- '/var/run/docker.sock:/var/run/docker.sock'
- './uptime-kuma:/app/data'
networks:
dns-mgt_net:
ipv4_address: 10.0.2.4

Is this wrong?

chakflying · 2023-04-29T14:22:47Z

Be aware the certificate file needs to be in the container as well. You can see in the above example the certificate directory is also mapped as a volume.

jslegers73 · 2023-04-30T14:06:49Z

Hi thanks for the answer. I have copied the ca.pem to /etc/pem in the container and added the volume in my docker yaml file

environment:
  NODE_EXTRA_CA_CERTS: '/home/pi/certs/ca.pem'
volumes:
  - '/var/run/docker.sock:/var/run/docker.sock'
  - '/home/pi/certs/ca.pem:/etc/ca.pem:ro'
  - './uptime-kuma:/app/data'

But I still got the error.
Then I did the following copied the ca.pem file to /usr/local/share/ca-certificates/ca.crt and executed the update-ca-certificates command. This also didn't work out.
I'm overseeing something very simple but don't see it unfortuantly sorry.

chakflying · 2023-04-30T15:04:27Z

NODE_EXTRA_CA_CERTS should point to a path inside the container, because you are telling the node.js process inside the container to find an extra certificate to load.

So if you have put your certificate file in /etc/ca.pem inside the container, the value of NODE_EXTRA_CA_CERTS should also be /etc/ca.pem.

jslegers73 · 2023-04-30T15:36:56Z

Worked like a charm.

SteffenBarthel · 2023-08-30T21:48:40Z

Is it possible to specify multiple certificates?
Example:

environment:
    NODE_EXTRA_CA_CERTS: '/home/ssl/a-ca.crt'
    NODE_EXTRA_CA_CERTS: '/home/ssl/b-ca.crt'

Unfortunately, this does not work.

louislam · 2023-08-31T04:12:17Z

@SteffenBarthel

You cannot define multiple NODE_EXTRA_CA_CERTS.

I think you can merge both files into a file by copy-and-paste its content.

SteffenBarthel · 2023-08-31T06:15:04Z

Thanks.
Merge the files works.

gnr8shn · 2024-11-15T06:32:02Z

Sorry for the necropost. This is what worked for us:

Note the /var/run/docker.sock is to monitor docker containers. We have another method for that.
The certificate mentioned is the pem formatted (-----BEGIN CERTIFICATE-----) internally signed public root and intermediate CA .

uptime-kuma:                              # uptime-kuma
   image: louislam/uptime-kuma:latest
   container_name: uptime-kuma
   environment:
     - NODE_EXTRA_CA_CERTS=/etc/XentooIntermediateAndRootCA.pem
   ports:
     - 127.0.0.1:3001:3001
   volumes:
     - uptime-kuma_data:/app/data
     - ./caddy_config/_data/XentooIntermediateAndRootCA.pem:/etc/XentooIntermediateAndRootCA.pem:ro
     # - /var/run/docker.sock:/var/run/docker.sock
   restart: always
   networks:
     - myBridge

<Edit: Add image>

Spintel (spintel.com.au) is the ISP with publicly signed certificate.
Portainer is a local docker instance fronted by Caddy that uses internal Smallstep Step-CA Certificate Authority. It uses ACME so the expiry is short.

begunfx · 2025-01-11T01:10:27Z

I'm having trouble getting this to work. I followed this thread and think I did everything that was mentioned to get it to work, but I'm still having issues.

I'm trying to monitor filebot which is setup with encryption (to use authentication), so the https address is: https://myserver:5800

I tried checking the ignore tls/ssl errors for https sites but that didn't work. I'm running uptime kuma in a docker container on a synology server. I tried exporting the self-signed certificate from the server and use the cert.pem file.

This is my docker compose file:

version: "3.9"
services:
  uptimekuma:
    image: louislam/uptime-kuma
    container_name: Uptime-Kuma
    hostname: uptimekuma
    mem_limit: 3g
    cpu_shares: 1024
    security_opt:
      - no-new-privileges:false
    ports:
      - 3444:3001
    volumes:
      - /volume1/docker/uptimekuma:/app/data:rw
      - /var/run/docker.sock:/var/run/docker.sock
      - /volume1/docker/uptimekuma/certs/filebot.self-signed-cert.pem:/etc/filebot.self-signed-cert.pem:ro
    environment:
      TZ: America/Los_Angeles
      NODE_EXTRA_CA_CERTS: /etc/filebot.self-signed-cert.pem
    restart: unless-stopped

What am I missing?

homelab-alpha · 2025-01-11T08:49:50Z

@begunfx,

Guide: Installing a Root CA Certificate on Debian/Ubuntu

This guide explains how to install a root CA certificate on a Debian or Ubuntu system. Replace root_ca_demo_cert.crt with the name of your own root CA certificate. Ensure that the file extension of your certificate is .crt and not .pem.

Preparation

The certificate used in this example, root_ca_demo_cert.crt, is for demonstration purposes only. Use your own root CA certificate for production environments.

1. Copy the certificate to the correct directory

Ensure that the certificate file is located in your home directory. Then, copy the root CA certificate to the /usr/local/share/ca-certificates directory:

sudo cp ~/root_ca_demo_cert.crt /usr/local/share/ca-certificates

Here, ~/ refers to your home directory.

2. Adjust file permissions

Set the correct file permissions to make the certificate readable by the system:

sudo chmod 644 /usr/local/share/ca-certificates/root_ca_demo_cert.crt

Explanation of chmod 644:

6 for the owner (root): read and write permissions (4 for read + 2 for write = 6).
4 for the group: read-only permissions.
4 for others: read-only permissions.

3. Update CA certificates

Update the list of trusted certificates with the following command:

sudo update-ca-certificates

This process detects new certificates in the /usr/local/share/ca-certificates directory and adds them to the system.

4. Configure the certificate for Uptime Kuma

If you are using the certificate with Uptime Kuma, modify your docker-compose.yml file. Add the following configuration:

volumes:
  - /usr/local/share/ca-certificates:/app/data/docker-tls

environment:
  NODE_EXTRA_CA_CERTS: /app/data/docker-tls/root_ca_demo_cert.crt

With this configuration, the root CA certificate is made available to the Uptime Kuma container via a volume, and it is set as an additional CA certificate in the environment.

Conclusion

You have successfully installed a root CA certificate on your Debian/Ubuntu system and configured it for use with the Docker Uptime Kuma container. Be sure to take any additional steps if your certificate has specific requirements.

begunfx · 2025-01-11T22:31:55Z

Thanks for the info. I'll play with creating a new self signed cert and see if that solves the problem.

homelab-alpha · 2025-01-11T22:41:41Z

Thanks for the info. I'll play with creating a new self signed cert and see if that solves the problem.

https://homelab-alpha.nl/openssl/quickstart/

EricEngardio added the help label Mar 16, 2022

EricEngardio closed this as completed Apr 4, 2022

Aterfax mentioned this issue Oct 11, 2022

Matrix - Unable to verify the first certificate #1904

Closed

2 tasks

chakflying mentioned this issue Feb 13, 2023

unable to verify the first certificate, no alarm with nocheck-tls-errors #2768

Closed

4 tasks

nobbs mentioned this issue Sep 5, 2023

feat: add option to mount additional existing volumes dirsigler/uptime-kuma-helm#128

Merged

2 tasks

ricardoapl mentioned this issue Sep 14, 2023

Support self-signed certificates k3rnelpan1c-dev/uptime-kuma-helm#138

Closed

CommanderStorm mentioned this issue Feb 28, 2024

Still alert for certificate expires, even if TLS/SSL errors for HTTPS sites are ignored #4540

Closed

2 tasks

t-k365 mentioned this issue Aug 14, 2024

When using proxy: Host marked as down because of "self-signed certificate" error even though "Ignore TLS/SSL error for HTTPS websites" is checked #5017

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HTTPS Monitor Down with Self-Signed Cert #1380

HTTPS Monitor Down with Self-Signed Cert #1380

EricEngardio commented Mar 16, 2022

louislam commented Mar 17, 2022

EricEngardio commented Mar 28, 2022

EricEngardio commented Mar 29, 2022

mmguero commented Apr 1, 2022

Kampfmoehre commented Apr 26, 2022

EricEngardio commented Oct 11, 2022 via email

d3xt3r01 commented Feb 10, 2023

jslegers73 commented Apr 29, 2023

chakflying commented Apr 29, 2023

jslegers73 commented Apr 30, 2023

chakflying commented Apr 30, 2023

jslegers73 commented Apr 30, 2023

SteffenBarthel commented Aug 30, 2023 •

edited

Loading

louislam commented Aug 31, 2023

SteffenBarthel commented Aug 31, 2023

gnr8shn commented Nov 15, 2024 •

edited

Loading

begunfx commented Jan 11, 2025 •

edited by chakflying

Loading

homelab-alpha commented Jan 11, 2025

begunfx commented Jan 11, 2025

homelab-alpha commented Jan 11, 2025

HTTPS Monitor Down with Self-Signed Cert #1380

HTTPS Monitor Down with Self-Signed Cert #1380

Comments

EricEngardio commented Mar 16, 2022

⚠️ Please verify that this bug has NOT been raised before.

🛡️ Security Policy

📝 Describe your problem

🐻 Uptime-Kuma Version

💻 Operating System and Arch

🌐 Browser

🐋 Docker Version

🟩 NodeJS Version

louislam commented Mar 17, 2022

EricEngardio commented Mar 28, 2022

EricEngardio commented Mar 29, 2022

mmguero commented Apr 1, 2022

Kampfmoehre commented Apr 26, 2022

EricEngardio commented Oct 11, 2022 via email

d3xt3r01 commented Feb 10, 2023

jslegers73 commented Apr 29, 2023

chakflying commented Apr 29, 2023

jslegers73 commented Apr 30, 2023

chakflying commented Apr 30, 2023

jslegers73 commented Apr 30, 2023

SteffenBarthel commented Aug 30, 2023 • edited Loading

louislam commented Aug 31, 2023

SteffenBarthel commented Aug 31, 2023

gnr8shn commented Nov 15, 2024 • edited Loading

begunfx commented Jan 11, 2025 • edited by chakflying Loading

homelab-alpha commented Jan 11, 2025

Guide: Installing a Root CA Certificate on Debian/Ubuntu

Preparation

1. Copy the certificate to the correct directory

2. Adjust file permissions

3. Update CA certificates

4. Configure the certificate for Uptime Kuma

Conclusion

begunfx commented Jan 11, 2025

homelab-alpha commented Jan 11, 2025

SteffenBarthel commented Aug 30, 2023 •

edited

Loading

gnr8shn commented Nov 15, 2024 •

edited

Loading

begunfx commented Jan 11, 2025 •

edited by chakflying

Loading