I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful.
Ultimately what I'm trying to do is to add a particular Helm repository to a Kubernetes deployment. This has worked fine in my testing environment (AWS), but it's failing in my prod environment (an on-prem cluster provided by a client) due to SSL issues. Specifically, the command I'm running is:
helm repo add polyaxon https://charts.polyaxon.com
And the error I get back is:
Error: Looks like "https://charts.polyaxon.com" is not a valid chart repository or cannot be reached: Get https://charts.polyaxon.com/index.yaml: x509: certificate signed by unknown authority
This is confusing to me because:
- I do not get this error when working locally or on AWS.
- When I go to the above url in my browser, it appears to have a valid cert issued by COMODO.
- Polyaxon is a fairly popular project, and this is a basic step in using it. And yet I can't find a single instance of this happening to anyone else.
Attempting to access the repo via
wget yields a more helpful error message:
:~$ wget https://charts.polyaxon.com --2019-02-22 22:02:53-- https://charts.polyaxon.com/ Resolving charts.polyaxon.com (charts.polyaxon.com)... 220.127.116.11, 18.104.22.168, 2606:4700:30::681b:9586, ... Connecting to charts.polyaxon.com (charts.polyaxon.com)|22.214.171.124|:443... connected. ERROR: cannot verify charts.polyaxon.com's certificate, issued by \u2018emailAddressfirstname.lastname@example.org,CN=FGT37D4615801045,OU=Certificate Authority,O=Fortinet,L=Sunnyvale,ST=California,C=US\u2019: Self-signed certificate encountered. To connect to charts.polyaxon.com insecurely, use `--no-check-certificate'.
What's interesting/confusing about this is that, as best I can tell, it's saying that the cert is issued by "Fortinet" and not by COMODO. I had never heard of Fortinet, so I googled them and discovered that they're not in the business of issuing SSL certs but instead of providing heavy-duty firewalls and the like. I also came across links like this and this, which seemed like they might be related.
So at this point my working theory is that the client has installed some Fortinet product on the network and that this product is causing an opaque SSL error that I wouldn't see elsewhere. But again, I'm way out of my depth here. Good chance I'm wrong, and even if I'm right, I still wouldn't know how to fix the issue.
So with that said, my questions are:
- What do you think is going on?
- How do I fix it?
Note that, if it's helpful, I can explicitly pass certs to helm via the options here.