step ssh config --roots returns x509: certificate signed by unknown authority

[marcheyer]

Hello,

i'm trying to setup ssh certificates with a kubernetes hosted CA for an ec2 jumphost.
I'm following https://smallstep.com/blog/diy-single-sign-on-for-ssh/ as a guideline.
What i have done so far:

1. I created the necessary files for the secrets used by the Helmchart of stepCA locally.
2. I rewrote the path definitions in the files to match the structure in the container
3. I deployed the files as k8s secrets
4. I deployed the Helmchart
5. This is working so far.
6. I deployed the https://gist.github.com/tashian/fde43668cbf6e3227fb13ef51db650b8 script to the ec2 instance which i want to connect to via ssh certificates.

Now the Problem:
The script runs
step ca bootstrap --ca-url $CA_URL --fingerprint $CA_FINGERPRINT
which yields:
The root certificate has been saved in /home/ubuntu/.step/certs/root_ca.crt.
The authority configuration has been saved in /home/ubuntu/.step/config/defaults.json.

This looks good to me.

But the next step step ssh config --roots > $(step path)/certs/ssh_user_key.pub
yields
error getting ssh public keys: client GET https://ca.example.com/ssh/roots failed: tls: failed to verify certificate: x509: certificate signed by unknown authority

Can you give me a hint what i'm doing wrong?

Best regards

[tashian]

Looks like you've gotten pretty far along!

First thing I would check is the certificate validity on that endpoint.
Does the output of step certificate inspect https://ca.example.com --bundle give you a certificate bundle that chains back up to your root CA whose fingerprint is $CA_FINGERPRINT?
If you're using step-ca directly, it will match.
If you're using step-ca through a reverse proxy, it may not.
Since it's Kubernetes, I'm suspecting there's a proxy involved here.
If that's the case, see Proxying step-ca traffic for details on how to address the issue.

[marcheyer]

Thank you @tashian i will procced here in a while. Unfortunatly i got a higher prioritized task i have to deal with for now.

[stastka]

I had the same error. I have step-ca behind an Nginx reverse proxy, and my mistake was using the leaf certificate instead of the fullchain in Nginx. Updating to the fullchain fixed it for me.