Setting up ssl/tls for docker

Community Containers
24

I evenetually trashed my whole server, reloaded Ubuntu 22.04 and decided to try the installation from source again based on the greenbone official documentation.
This worked finally and got the system running without SSL (Again, why is this even a default setup. Default i.m.o should be ssl).

After some research found the changes required for SSL, got myself a proper SSL cert and configured accordingly. everything working now as it should.

25

This worked for me and doesn’t require much configuration.

  • Create your cert
    openssl req -x509 -newkey rsa:4096 -keyout serverkey.pem -out servercert.pem

  • Place in a location of choice, in my case:
    /etc/greenbone/cert/

  • Update docker-compose.yml

gsa:
    image: greenbone/gsa:stable
    restart: on-failure
    environment:
       - GSAD_ARGS=--gnutls-priorities=SECURE256:-VERS-TLS-ALL:+VERS-TLS1.2:+VERS-TLS1.3
    ports:
            - "443:443"
    volumes:
      - /tmp/gvm/gvmd:/run/gvmd
      - /etc/greenbone/cert/serverkey.pem:/var/lib/gvm/private/CA/serverkey.pem:rw,mode=644
      - /etc/greenbone/cert/servercert.pem:/var/lib/gvm/CA/servercert.pem:rw,mode=644
    depends_on:
      - gvmd

No additional configuration should be required.

Some observations:

  • Multiple GSAD_ARGS like --arg1 --arg2 will not be passed or used properly by start-gsad
  • Using other names than “servercert.pem” and “serverkey.pem” doesn’t work using this setup :thinking:

Thanks 3lackhawk for the arg to disable depreciated TLS versions, and to all other contributors of course.

3 Likes
26

Good afternoon,

I have already tried several given solutions, but none of them worked. Can anyone help me? The service runs on the right port but does not work with HTTPS, it only runs on port 443 but in HTTP. :frowning:

Thanks

27

I wanted to comment here as I was having exact same issue as tomiking.

My solution was after running openssl command to generate cert/key to change the private key ownership on host machine to 1001:1001 from 1000:1000 because 1000 is the UID of the user of your host machine you are using but the container has user gsad with UID 1001 as seen in /etc/passwd if you exec into container.

This fixed ssl for me.

1 Like
28

Hi everyone, I was having some issues on my test network and managed to create the working docker image.

Changes:

1 - Include:

image
image719×258 5.39 KB

DON’T FORGET TO CHANGE /home/usuario/ to your default user, other than ROOT

  • GSAD_ARGS=–http-sts
  • GSAD_ARGS=–no-redirect
  • GSAD_ARGS=–gnutls-priorities=SECURE256:-VERS-TLS-ALL:+VERS-TLS1.2:+VERS-TLS1.3

2 - AS A USER, create the certificate:

openssl req -x509 -newkey rsa:4096 -keyout serverkey.pem -out servercert.pem -nodes -days 9365

3 - Give permissions to the cert:

chmod 666 serverkey.pem

4 - How to ROOT:

systemctl start docker

5 - Check GSA logs

docker ps -a

search for greenbone/gsa:stable and copy its CONTAINER ID

docker exec -it “Enter the container here” bash

cat /var/log/gvm/gsad.log

If informed: Starting GSAD version 22.08.0

This means it started without any problems.

6 - Close the Docker-Proxy connection

ss -tulpn (Search for docker-proxy and copy the SID)

kill -9 SID-DOCKER-PROXY

xdg-open “https://10.10.10.10:443” 2>/dev/null >/dev/null &

7 - Try accessing your website now:

https://10.10.10.10

1 Like