<p>I use the following code with <a href="https://github.com/coreos/go-oidc" rel="nofollow noreferrer">this</a> lib</p>
<pre><code>provider, err := oidc.NewProvider(ctx, providerURI)
if err != nil {
    log.Println(err)
}
</code></pre>
<p>While running it locally <strong>with same providerURI</strong> it <strong>works</strong>,
I was able to get the provider successfully!</p>
<p>I deployed it to K8S with the <strong>exact same provider url</strong> (as <code>env</code> variable ) and <strong>debug</strong> it using <code>port-forwarding</code> ,
However, in k8S I got error and dont get the <code>provider</code>.</p>
<p><strong>The error is:</strong></p>
<pre><code>2020/08/14 16:42:22 Get &quot;https://ace.svar.com/.well-known/openid-configuration&quot;: x509: certificate signed by unknown authority
</code></pre>
<p>I've added the certificate to the image and <strong>verify it</strong>, I <code>exec</code> into k8s container after deploy and I see the <code>server.crt</code> file under <code>/usr/local/share/ca-certificates/</code> path.</p>
<p>And still got the same error, any idea if I miss here something else ...
Not sure if it really related to the OIDC lib or something more general..</p>
<pre><code>FROM golang:1.14.7 AS builder
RUN go get github.com/go-delve/delve/cmd/dlv
ADD server.crt /usr/local/share/ca-certificates/server.crt
RUN chmod 644 /usr/local/share/ca-certificates/server.crt &amp;&amp; update-ca-certificates
RUN mkdir /app

ADD . /app
WORKDIR /app
RUN CGO_ENABLED=0 GOOS=linux go build -gcflags=&quot;all=-N -l&quot; -o main ./...

FROM debian:buster AS production
COPY --from=builder /app .
COPY --from=builder /go/bin/dlv /
COPY --from=builder /usr/local/share/ca-certificates/ /usr/local/share/ca-certificates/
EXPOSE 8000 40000
ENV SSL_CERT_DIR=/usr/local/share/ca-certificates/
ENV PORT=8000
CMD [&quot;/dlv&quot;, &quot;--listen=:40000&quot;, &quot;--headless=true&quot;, &quot;--api-version=2&quot;, &quot;--accept-multiclient&quot;, &quot;exec&quot;, &quot;./main&quot;]
</code></pre>
<p>I got replay from the author of the <code>GO-OIDC</code> repository to try to use</p>
<p><a href="https://godoc.org/github.com/coreos/go-oidc#ClientContext" rel="nofollow noreferrer">https://godoc.org/github.com/coreos/go-oidc#ClientContext</a></p>
<p>Not sure how, any idea?</p>

<p>From <a href="https://godoc.org/github.com/coreos/go-oidc#ClientContext" rel="noreferrer">oidc.ClientContext</a> docs it shows how to pass in a custom <code>http.Client</code>:</p>
<pre><code>myClient := &amp;http.Client{}
ctx := oidc.ClientContext(parentContext, myClient)

// This will use the custom client
provider, err := oidc.NewProvider(ctx, &quot;https://accounts.example.com&quot;)
</code></pre>
<p>providing a custom <code>http.Client</code> allows for custom TLS handling.</p>
<hr />
<h2>TLS Config</h2>
<p>To create a <code>http.Client</code> with a specific CA-trust file, I employ these helper functions:</p>
<pre><code>func tlsConf(trustfile string) (t *tls.Config, err error) {
    if trustfile == &quot;&quot; {
        // DON'T USE IN PRODUCTION (but handy for testing)
        t = &amp;tls.Config{InsecureSkipVerify: true}
        return
    }

    pembody, err := ioutil.ReadFile(trustfile)
    if err != nil {
        err = fmt.Errorf(&quot;failed to load trust file %q: %w&quot;, trustfile, err)
        return
    }

    rootCAs := x509.NewCertPool()
    if ok := rootCAs.AppendCertsFromPEM(pembody); !ok {
        err = fmt.Errorf(&quot;invalid PEM file %q&quot;, trustfile)
        return

    }

    t = &amp;tls.Config{RootCAs: rootCAs}
    return
}
</code></pre>
<p>and:</p>
<pre><code>func httpCli(trustfile string) (hc *http.Client, err error) {
    tc, err := tlsConf(trustfile)
    if err != nil {
        return
    }
    hc = &amp;http.Client{Transport: &amp;http.Transport{TLSClientConfig: tc}}
    return
}
</code></pre>
<p>So to use the above with the OIDC package for a quick test:</p>
<pre><code>hc, err := httpCli(&quot;&quot;) // DON'T USE IN PRODUCTION - will trust any TLS cert

ctx := oidc.ClientContext(parentContext, hc)
provider, err := oidc.NewProvider(ctx, &quot;https://accounts.example.com&quot;)
</code></pre>
<p>If this works, then add the correct trust file to your app:</p>
<pre><code>hc, err := httpCli(&quot;/usr/local/share/ca-certificates/server.crt&quot;))
</code></pre>
<hr />
<h2>CA Trust</h2>
<p>If your <code>server.crt</code> trust file is not working, you may have the wrong subject/issuer listed.</p>
<p>To know for sure, you can <a href="https://superuser.com/a/176721/417258">grab the trust cert</a> (and optional signing chain) from any remote server (port 443 is the default https port):</p>
<pre><code>echo | openssl s_client -connect ace.svar.com:443 -showcerts 2&gt; /dev/null &gt; ace.txt
</code></pre>
<p>Since I don't know what your infrastructure looks like, I'll use the example output from <code>google.com:443</code>:</p>
<pre><code>---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=*.google.com
   i:/C=US/O=Google Trust Services/CN=GTS CA 1O1
-----BEGIN CERTIFICATE-----
MIIKIzCCCQugAwIBAgIQF9rkH7fB/M4IAAAAAE2d0TANBgkqhkiG9w0BAQsFADBC
MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMRMw
...
-----END CERTIFICATE-----
</code></pre>
<p>The <code>s:</code> indicates the subject of a cert - and you can see the server name is identified by the wildcard <code>CN=*.google.com</code>. If you see something similar within <code>ace.txt</code> - your <code>server.crt</code> should include these lines (starting at <code>BEGIN CERTIFICATE</code> and ending with <code>END CERTIFICATE</code>).</p>
<p>You may also note the <code>i:</code> line indicates the issuer cert name. If this is the same name as <code>s:</code> - then it is self-signed cert and you are done.</p>
<p>In the <code>google.com:443</code> example the subject (<code>s:</code>) differs from the issuer (<code>i:</code>). So instead of trusting the subject cert - one can trust the issuer cert instead - allowing potentially multiple servers to be trust. Since the subject cert is signed by that issuer - the chain-of-trust is complete.</p>
