minio+KMS x509: certificate signed by unknown authority

Question

I am trying to use minio as a local S3 server. I am following this article

I downloaded key and cert files. I added the env parameters:

set MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373
set MINIO_KMS_KES_KEY_FILE=D:\KMS\root.key
set MINIO_KMS_KES_CERT_FILE=D:\KMS\root.cert
set MINIO_KMS_KES_KEY_NAME=my-minio-key

I started minio server: D:\>minio.exe server D:\Photos It logs after sturt up:

Endpoint:  http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000           
AccessKey: minioadmin
SecretKey: minioadmin

Browser Access:
   http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000                   

Command-line Access: https://docs.min.io/docs/minio-client-quickstart-guide
   $ mc.exe alias set myminio http://169.254.182.253:9000 minioadmin minioadmin

Object API (Amazon S3 compatible):
   Go:         https://docs.min.io/docs/golang-client-quickstart-guide
   Java:       https://docs.min.io/docs/java-client-quickstart-guide
   Python:     https://docs.min.io/docs/python-client-quickstart-guide
   JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
   .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin', please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'

I opened UI in browser: http://localhost:9000/minio/mybacket/ I tried to upload a jpg file and got an exception:

<?xml version="1.0" encoding="UTF-8"?> <Error><Code>InternalError</Code><Message>We encountered an internal error, please try again.</Message><Key>Completed.jpg</Key><BucketName>mybacket</BucketName><Resource>/minio/upload/mybacket/Completed.jpg</Resource><RequestId>1634A6E5663C9D70</RequestId><HostId>4a46a947-6473-4d53-bbb3-a4f908d444ce</HostId></Error>

And I got this exception in minio console:

Error: Post "https://play.min.io:7373/v1/key/generate/my-minio-key": x509: certificate signed by unknown authority
       3: cmd\api-errors.go:1961:cmd.toAPIErrorCode()
       2: cmd\api-errors.go:1986:cmd.toAPIError()
       1: cmd\web-handlers.go:1116:cmd.(*webAPIHandlers).Upload()

score 2 · Answer 1 · answered Sep 14 '20 at 15:47

Most probably your OS trust store (containing the Root CA certificates) does not trust Let's Encrypt (the Let's Encrypt Authority X3 CA certificate).

The server https://play.min.io:7373 serves a TLS certificates issued by Let's Encrypt. See:

openssl s_client -showcerts -servername play.min.io -connect play.min.io:7373

Eventually, check your the root CA store of your windows machine.
See: https://security.stackexchange.com/questions/48437/how-can-you-check-the-installed-certificate-authority-in-windows-7-8

minio+KMS x509: certificate signed by unknown authority

1 Answers1