WSL SSL certificate problem: unable to get local issuer certificat

Ziti Overlay
1

Hey,

I have set up Openziti for my homelab with:

  • Controller/Public Edge Router on the cloud
  • A SFF running in my home 24/7 with docker (running few containers like Gitea, etc)

I’ve successfully managed to configure Ziti Desktop Edge to access my services. For example I can access `https://git.lan.example.com` from my browser on Windows.

But for some reason when I try to `curl https://git.lan.example.com` on WSL I get this error:

`curl: (60) SSL certificate problem: unable to get local issuer certificate`

`curl https://git.lan.example.com -k` works perfectly.

Any Idea of what I’m missing ?

2

A more concrete example would be useful but this is a simple certificate issue. Whatever is responding to "git.lan.example.com" is returning a certificate that is not valid for "git.lan.example.com". This is common with intrusion detection that does MITM type of activitiy. It's also possible your WSL ca certs are out of date compared to your windows machine.

I'd ask GPT or some other LLM this one. Based on what you've shared so far, this doesn't strike me as any sort of OpenZiti problem

3

The certificate is a Let’s encrypt generated one.

When I try to get the certificate using open ssl, It’s not finding any:

❯ openssl s_client -connect git.lan.example.com:443 -showcerts | grep -E "(BEGIN|END) CERTIFICATE"
depth=0 CN = git.lan.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = git.lan.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

I guess that’s not really an Openziti issue, but something might be wrong on my WSL. I’ve already tried gpt and looked into this Intercept DNS names are not resolving in WSL But nothing worked so far :confused:

4

Like I said, based on what you're showing/telling me this doesn't seem to me to be an OpenZiti issue. OpenZiti won't modify your packets at all.

It's possible you've misconfigured your offload or port. I'd double check your configuration and make sure you're going to the proper server.

My expectation is that your os ca certs are out of date. Use an LLM/GPT to find out how to update your WSL instance. Good luck! :slight_smile:

5

You’re right. After some back and forth with gpt, I was missing this cert `https://letsencrypt.org/certs/2024/e6.pem\`

1 Like