SSL certificate problem: unable to get local issuer certificate (only when certificate managed by Terraform)

Question

I am trying on an Elasticsearch cluster to set up HTTPS for clients. It works fine when I generate an SSL certificate from the cluster using certbot via the following command:

certbot certonly --standalone

My Elasticsearch cluster is configured as follows:

# elasticsearch.yml

cluster.initial_master_nodes: 10.132.0.3
cluster.name: elasticsearch
discovery.seed_hosts: 10.132.0.3:9200
network.host: 10.132.0.3
node.name: node-1
xpack.security.http.ssl.certificate: /etc/elasticsearch/ssl/my-subdomain.XXXX.com/fullchain.pem
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: /etc/elasticsearch/ssl/my-subdomain.XXXX.com/privkey.pem
xpack.security.http.ssl.verification_mode: certificate
xpack.security.transport.ssl.enabled: true

I thus manage to authenticate in HTTPS on my elasticsearch using my login and password, via the following command:

curl https://my-subdomain.XXXX.com:9200 -u username:password

My problem is that I would now like to do the same operation but by generating the SSL certificate via Terraform using the ACME provider and more precisely with the resource "acme_certificate". Here is my Terraform code:

resource "acme_certificate" "elastic" {
  account_key_pem = acme_registration.account_registration.account_key_pem
  common_name = "${local.subdomain}.${var.domain_name}"

  dns_challenge {
    provider = "ovh"

    config = {
      OVH_ENDPOINT = var.ovh_endpoint
      OVH_APPLICATION_KEY = var.ovh_application_key
      OVH_APPLICATION_SECRET = var.ovh_application_secret
      OVH_CONSUMER_KEY = var.ovh_consumer_key
    }
  }
}

From Terraform resource "acme_certificate" I get the following outputs:

"certificate_pem" which will become my "cert.pem" file (but I am not using it in my Elasticsearch setup)
"issuer_pem"
"private_key_pem" which will become my "privkey.pem" file

I am therefore missing the "fullchain.pem" file that I build by associating the "certificate_pem" and "issuer_pem" as follows (my error may be there):

resource "local_file" "fullchain" {
  content = "${acme_certificate.elastic.certificate_pem}${acme_certificate.elastic.issuer_pem}"
  filename = "/my/local/path/fullchain.pem"
}

My "fullchain.pem" file looks like this:

In the same way as with cerbot, I inject my certificate into Elasticsearch with Terraform and verify that the Elastic user has the correct rights (with the chmod and chown commands) The elasticsearch service restarts fine, but when I try to connect it gives me the following error:

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

I don't understand what the problem is, I have the impression that the certificate returned by Terraform is not correct. But when I test their validity with cerbot, everything seems OK:

openssl x509 -enddate -noout -in cert.pem       # notAfter=Nov 16 13:55:54 2021 GMT
openssl x509 -enddate -noout -in fullchain.pem  # notAfter=Nov 16 13:55:54 2021 GMT

Thanks for your help !

Can you include the cert chain in your question please? Note, this shouldn't include the private key and just the intermediate and the issued certificate. — ydaetskcoR, Aug 20 '21 at 13:01
@ydaetskcoR, Do you want me to add the "fullchain.pem" file or the "cert.pem" file? — David, Aug 20 '21 at 13:07
Your cert appears to be issued by the staging Let's Encrypt environment. The root CA for this is not in browser/OS trust stores so might be the issue you're seeing there. — ydaetskcoR, Aug 20 '21 at 13:19
I'm also not sure why you've since edited the question to remove the middle of the certs in the chain. Certs are public by their nature (and since CertificateTransparency you can't even hide the presence of internal resource domain names when a certificate is issued) so you should be able to leave the cert in full in your question to help people debug your certificate issues. — ydaetskcoR, Aug 20 '21 at 13:21
OK, thanks @ydaetskcoR, I was wondering if this could be sensitive data. I put it back in full — David, Aug 20 '21 at 13:24
As long as you don't include the key then it's fine and any user who visited the site would retrieve the certs anyway so they are meant to be public. Prior to Certificate Transparency people would occasionally want to hide the domain names of internal facing resources but Certificate Transparency logs will include this now anyway and anyone seeking to find internal resources on your domain will check those by default rather than hope to find things on Stack Overflow. — ydaetskcoR, Aug 20 '21 at 13:27
Can you confirm that you are using the staging LE server? If so does it still have the issue if you switch to the production LE server? — ydaetskcoR, Aug 20 '21 at 13:28
I understand your idea, it is true that I went through the Lets'encrypt staging environment to avoid reaching a certain limit at the time of renewal (because I am currently working on a development environment). I will redo the operation via the production environment of LE — David, Aug 20 '21 at 13:33
@ydaetskcoR, I just tested from the LE production environment. Unfortunately, I have the exact same problem — David, Aug 20 '21 at 14:11
Can you update the certificates in the question with the production LE certs please? — ydaetskcoR, Aug 20 '21 at 15:00
I have not found the solution to my problem, but comparing the fullchain.pem files between the Certbot method and the Terraform method, I realize that the 2 are indeed composed of 3 parts : - the first part which corresponds to the cert.pem file is different between the 2 methods - the second and third part corresponding to the "issuer" are on the other hand perfectly identical — David, Aug 20 '21 at 17:10

SSL certificate problem: unable to get local issuer certificate (only when certificate managed by Terraform)

0 Answers0