[SSO] Private certificate doesn't work with RustSSL #7192
Replies: 4 comments 15 replies
|
The best thing to do is the following which ensures both host certificates and your custom self-signed certificates will work. Either place all Self-Signed certs into one file, or create one per file with a name to distinguish them from each other. Then run Vaultwarden by adding these options to: -v "${PWD}/self-signed/my-cert.pem:/etc/ssl/certs/my-cert.pem" \
-e SSL_CERT_DIR="/etc/ssl/certs" -e SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt"Or via compose: services:
vaultwarden:
image: vaultwarden/server:latest
environment:
SSL_CERT_DIR: /etc/ssl/certs
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
volumes:
- ./self-signed/my-cert.pem:/etc/ssl/certs/my-cert.pem:roThis will ensure your certificate is loaded correctly and trusted by the http client used inside Vaultwarden. |
|
Thanks for the quick reply. My Vaultwarden instance is running on an RKE cluster, so I deploy it using a And on my vaultwarden pod i can see that my cert is proprely intergrated: |
|
As mentioned, you need to use the ENV's i provided. I use self-signed certs for my local development too, and those work without any issues. |
|
Also, if you try to use the |
|
Also, I just tested it again running a docker image via docker run, and it works without any issues. |
|
I tested it with ENV's, but it still get the bug. I have my cert on 'ca-certifiacates.crt' Maybe it's working on docker but not on RKE2 ? |
|
I doubt the environment has anything to do with it, It's just as simple as the library which checks for the environment variables It works for me also by only providing I would suggest to see if you can determine if those environment variables are loaded or not within the container. |
|
Thanks for the detailed feedback. I want to clarify what I already tested, because I strongly suspect this is not a certificate issue. I tested both Kubernetes (RKE2) and a Docker setup, fully applying your recommendations (SSL_CERT_DIR / SSL_CERT_FILE, CA mount, update-ca-certificates). In all cases, the result is the same: Failed to discover OpenID provider: Request failed Certificate validation and TLS are both fully OK:
I also validated the TLS handshake directly:
Result:
So from a TLS/certificate perspective, everything is correct. The key point is:
This indicates the problem is not the certificate itself, but rather how rustls handles or loads system/custom CA trust in this environment (RKE2 / containerized setup). At this point:
I guess this points more toward a regression introduced by the TLS backend change rather than a certificate misconfiguration. |
|
I had the same issues with other software that uses RusTLS. As far as I'm aware, with the current versions it works only if none of the certificates in the chain are signed with SHA-512. |
|
I can reproduce the same issue on my side, but my certificate chain is not using SHA-512. A few facts from my setup:
For clarity, my internal certificate generation script uses -sha256, so the SHA-512 explanation does not apply to my case. |
|
I still can reproduce the error with the latest version (1.37.0). |
|
Do you see any logs regarding the failed Cert? Or does it just fail? |
|
I got a different log as before : [2026-07-27 15:09:47.614][response][INFO] (get_org_domain_sso_verified) POST /api/organizations/domain/sso/verified => 200 OK From the log i can see that my signature isn't supported by tls |
|
The Problem here is the It also isn't as simple as just switching got The only thing i can offer as a midway solution is adding something like stunnel or a reverse proxy between it which offers a different certificate to the Vaultwarden server. Or, just sign the cert with a different algorithm. |
Uh oh!
There was an error while loading. Please reload this page.
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Config:
{ "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "*****://*********************************************************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "dns_prefer_ipv6": false, "domain": "*****://************************", "domain_origin": "*****://************************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_auth": "0 20 0 * * *", "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": true, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "************************", "smtp_from_name": "***********", "smtp_host": "*******************", "smtp_password": null, "smtp_port": 25, "smtp_security": "off", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "sso_allow_unknown_email_verification": false, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "*****://****************************************", "sso_authorize_extra_params": "", "sso_callback_path": "*****://*****************************************************", "sso_client_cache_expiration": 0, "sso_client_id": "***********", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": true, "sso_master_password_policy": null, "sso_only": true, "sso_pkce": true, "sso_scopes": "openid profile email offline_access", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null }Vaultwarden Build Version
v1.35.3
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
nginx
Host/Server Operating System
Linux
Operating System Version
No response
Clients
Web Vault
Client Version
No response
Steps To Reproduce
Expected Result
Expeted a redirection to sso client (keycloak on my case)
Actual Result
Raise an error "Failed to discover OpenID provider: Request failed"
Logs
Screenshots or Videos
{
"message": "Failed to discover OpenID provider: Request failed",
"validationErrors": {
"": [
"Failed to discover OpenID provider: Request failed"
]
},
"errorModel": {
"message": "Failed to discover OpenID provider: Request failed",
"object": "error"
},
"error": "",
"error_description": "",
"exceptionMessage": null,
"exceptionStackTrace": null,
"innerExceptionMessage": null,
"object": "error"
}
Additional Context
My SSO connection was working on v1.35.3 and earlier versions, but since the migration from native-TLS to rustls-TLS (see image), I have been unable to connect Vaultwarden to Keycloak.
I suspect the issue comes from my certificate, as it is a private certificate, and I have seen similar bug reports. The certificate is properly integrated into the project and works with older versions.
All reactions