Gitea authentication with custom certificate authority #13796

New Issue

GiteaMirror · 2025-11-02T10:53:29-06:00

GiteaMirror commented

2025-11-02 10:53:29 -06:00

Originally created by @CrashSensei on GitHub (Dec 6, 2024).

Description

Problem

The Gitea authentication process does not correctly use the operating system certificate authority collection.

I have a custom CA and mounted my full certificate authority chain to /etc/ssl/certs/ca-certificates.crt.
However, when I attempted to setup OAuth2 I received the error:

Caution

tls: failed to verify certificate: x509: certificate signed by unknown authority

I verified that the container OS ca-certs were working correctly by using curl inside the container:

podman exec -it --user git gitea-app curl https://keycloak.fake.com/realms/main/.well-known/openid-configuration

I found a previous issue referencing this same problem:
https://github.com/go-gitea/gitea/issues/29420#issue-2153633491

Referencing their workaround, I mounted my root and sub ca certs separately under the /etc/ssl/certs directory.
Gitea now correctly verified the custom certificate. However, the container OS no longer recognized the custom ca (curl fails).

I have verified that the same issue exists for LDAP authentication.

Solution

Gitea should use the standard OS CA collection instead of scanning the CA directory. For Alpine Linux that is /etc/ssl/ca-certificates.crt or /etc/ssl/cert.pem (a symlink to the former).

Gitea Version

1.22.4

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Docker container docker.io/gitea/gitea:1.22.3

How are you running Gitea?

Launching docker container via systemd using podman

Database

None

Originally created by @CrashSensei on GitHub (Dec 6, 2024). ### Description ### Problem The Gitea authentication process does not correctly use the operating system certificate authority collection. I have a custom CA and mounted my full certificate authority chain to /etc/ssl/certs/ca-certificates.crt. However, when I attempted to setup OAuth2 I received the error: > [!CAUTION] > tls: failed to verify certificate: x509: certificate signed by unknown authority I verified that the container OS ca-certs were working correctly by using curl inside the container: ```shell podman exec -it --user git gitea-app curl https://keycloak.fake.com/realms/main/.well-known/openid-configuration ``` I found a previous issue referencing this same problem: https://github.com/go-gitea/gitea/issues/29420#issue-2153633491 Referencing their workaround, I mounted my root and sub ca certs separately under the /etc/ssl/certs directory. Gitea now correctly verified the custom certificate. However, the container OS no longer recognized the custom ca (curl fails). I have verified that the same issue exists for LDAP authentication. ### Solution Gitea should use the standard OS CA collection instead of scanning the CA directory. For Alpine Linux that is /etc/ssl/ca-certificates.crt or /etc/ssl/cert.pem (a symlink to the former). ### Gitea Version 1.22.4 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System Docker container docker.io/gitea/gitea:1.22.3 ### How are you running Gitea? Launching docker container via systemd using podman ### Database None

GiteaMirror added the type/bug label 2025-11-02 10:53:29 -06:00

GiteaMirror commented

2025-11-02 10:53:29 -06:00

@ptman commented on GitHub (Apr 11, 2025):

https://github.com/go-gitea/gitea/issues/14102

@ptman commented on GitHub (Apr 11, 2025): https://github.com/go-gitea/gitea/issues/14102

Sign in to join this conversation.