minio+KMS x509：未知权威签署的证书答案

【问题标题】：minio+KMS x509: certificate signed by unknown authorityminio+KMS x509：未知权威签署的证书
【发布时间】：2020-09-14 23:47:47
【问题描述】：

我正在尝试使用minio 作为本地 S3 服务器。我正在关注这个article

我下载了密钥和证书文件。我添加了环境参数：

set MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373
set MINIO_KMS_KES_KEY_FILE=D:\KMS\root.key
set MINIO_KMS_KES_CERT_FILE=D:\KMS\root.cert
set MINIO_KMS_KES_KEY_NAME=my-minio-key

我启动了minio服务器：D:\>minio.exe server D:\Photos 启动后记录：

Endpoint:  http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000           
AccessKey: minioadmin
SecretKey: minioadmin

Browser Access:
   http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000                   

Command-line Access: https://docs.min.io/docs/minio-client-quickstart-guide
   $ mc.exe alias set myminio http://169.254.182.253:9000 minioadmin minioadmin

Object API (Amazon S3 compatible):
   Go:         https://docs.min.io/docs/golang-client-quickstart-guide
   Java:       https://docs.min.io/docs/java-client-quickstart-guide
   Python:     https://docs.min.io/docs/python-client-quickstart-guide
   JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
   .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin', please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'

我在浏览器中打开 UI：http://localhost:9000/minio/mybacket/ 我尝试上传 jpg 文件并出现异常：

<?xml version="1.0" encoding="UTF-8"?> <Error><Code>InternalError</Code><Message>We encountered an internal error, please try again.</Message><Key>Completed.jpg</Key><BucketName>mybacket</BucketName><Resource>/minio/upload/mybacket/Completed.jpg</Resource><RequestId>1634A6E5663C9D70</RequestId><HostId>4a46a947-6473-4d53-bbb3-a4f908d444ce</HostId></Error>

我在 minio 控制台中遇到了这个异常：

Error: Post "https://play.min.io:7373/v1/key/generate/my-minio-key": x509: certificate signed by unknown authority
       3: cmd\api-errors.go:1961:cmd.toAPIErrorCode()
       2: cmd\api-errors.go:1986:cmd.toAPIError()
       1: cmd\web-handlers.go:1116:cmd.(*webAPIHandlers).Upload()

【问题讨论】：

标签： aws-kms minio

【解决方案1】：

很可能您的操作系统信任库（包含根 CA 证书）不信任 Let's Encrypt（Let's Encrypt Authority X3 CA 证书）。

服务器https://play.min.io:7373 提供由 Let's Encrypt 颁发的 TLS 证书。见：

openssl s_client -showcerts -servername play.min.io -connect play.min.io:7373

最后，检查您的 Windows 机器的根 CA 存储。
见：https://security.stackexchange.com/questions/48437/how-can-you-check-the-installed-certificate-authority-in-windows-7-8

【讨论】：