title: Kong API Gateway SSL/TLS Certificates
body: <p>I got a problem with SSL/TLS Termination on Kong API Gateway. HTTPS Requests using curl and Insomnia got response that <strong>SSL certificate problem: unable to get local issuer certificate</strong>.
  Certificate is valid and issued by well known issuer, so CA certificate is already in the clients known CA list.
  In Browser HTTPS requests works fine.</p>
  <p>I'm using <strong>Kong version 2.7.1</strong></p>
  <p><strong>docker-compose.yaml</strong> configured in next way:</p>
  <pre><code>  kong:
      image: kong:2.7.1
      container_name: kong-api-gw
      restart: always
      networks:
        kong-net:
          ipv4_address: 172.16.1.11
      volumes:
        - kong-volume:/etc/kong
        - kong-volume-conf:/usr/local/kong
      environment:
        KONG_DATABASE: postgres
        KONG_PG_HOST: kong-database
        KONG_PG_DATABASE: kong
        KONG_PG_USER: ${KONG_PG_USER}
        KONG_PG_PASSWORD: ${KONG_PG_PASSWORD}
        KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
        KONG_ADMIN_LISTEN: 0.0.0.0:8001, 0.0.0.0:8444 ssl
        KONG_SSL: &quot;on&quot;
        KONG_SSL_CERT: /etc/kong/ssl/kong.crt
        KONG_SSL_CERT_KEY: /etc/kong/ssl/kong.key
        KONG_PROXY_ACCESS_LOG: /dev/stdout
        KONG_PROXY_ERROR_LOG:  /dev/stdout
      depends_on:
        - kong-database
      healthcheck:
        test: [&quot;CMD&quot;, &quot;kong&quot;, &quot;health&quot;]
        interval: 10s
        timeout: 10s
        retries: 10
      ports:
        - &quot;8000:8000&quot;
        - &quot;8001:8001&quot;
        - &quot;8443:8443&quot;
        - &quot;8444:8444&quot;
      deploy:
        resources:
          limits:
            cpus: &quot;2&quot;
            memory: &quot;4000M&quot;
      logging:
        driver: &quot;json-file&quot;
        options:
            max-file: &quot;3&quot;
            max-size: &quot;10M&quot;
  </code></pre>
  <p>Certificate was added using Admin API and Konga UI, i tried pem and crt, both of them.</p>
  <pre><code>curl -X POST http://127.0.0.1:8001/certificates -H 'Content-Type: multipart/form-data' -F cert=@./kong.pem -F key=@./kong.key -F snis[]=example.com
  </code></pre>
  <p>Inside docker container i put mycert.crt and mycert.key to /etc/kong/ssl/, but nothing helped and there are no errors in logs.</p>
  <p>Response from GET Request to <a href="https://example.com:8444/certificates" rel="nofollow noreferrer">https://example.com:8444/certificates</a> (when disable SSL Validation in Insomnia)</p>
  <pre><code>{
      &quot;data&quot;: [
          {
              &quot;key_alt&quot;: null,
              &quot;created_at&quot;: 1650871124,
              &quot;cert_alt&quot;: null,
              &quot;key&quot;: &quot;-----BEGIN RSA PRIVATE KEY-----\cert-key-example\n-----END RSA PRIVATE KEY-----&quot;,
              &quot;id&quot;: &quot;7ebdca61-4598-4e17-bdf8-2239c41ce09b&quot;,
              &quot;tags&quot;: null,
              &quot;snis&quot;: [
                  &quot;example.com&quot;
              ],
              &quot;cert&quot;: &quot;-----BEGIN CERTIFICATE-----\cert-example\n-----END CERTIFICATE-----&quot;
          }
      ],
      &quot;next&quot;: null
  }
  </code></pre>
  <p>Curl example</p>
  <pre><code>curl -i -v https://example.com:8443/api
  *   Trying ip:8443...
  * TCP_NODELAY set
  * Connected to example.com (ip) port 8443 (#0)
  * ALPN, offering h2
  * ALPN, offering http/1.1
  * successfully set certificate verify locations:
  *   CAfile: /etc/ssl/certs/ca-certificates.crt
    CApath: /etc/ssl/certs
  * TLSv1.3 (OUT), TLS handshake, Client hello (1):
  * TLSv1.3 (IN), TLS handshake, Server hello (2):
  * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  * TLSv1.3 (IN), TLS handshake, Certificate (11):
  * TLSv1.3 (OUT), TLS alert, unknown CA (560):
  * SSL certificate problem: unable to get local issuer certificate
  * Closing connection 0
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: https://curl.haxx.se/docs/sslcerts.html
  
  curl failed to verify the legitimacy of the server and therefore could not
  establish a secure connection to it. To learn more about this situation and
  how to fix it, please visit the web page mentioned above.
  </code></pre>