Using s3 minio self singed cert

InfluxDB 3
,
1

Hello ,
i am trying to mount Influxdb 3 core to connect to my minio storage , the storage is configured with self singed , using docker compose , my docker compose as follows below , i tried various configuration but allways get following error , please ,how to get this working ignoring the cert validation
Please advice
Thanks

Serve command failed: failed to initialize catalog: object store error: ObjectStore(Generic { store: "S3", source: Reqwest { retries: 10, max_retries: 10, elapsed: 2.39886866s, retry_timeout: 180s, source: reqwest::Error { kind: Request, source: hyper_util::client::legacy::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) } } })

------docker compose------

services:
  influxdb3-core:
    container_name: influxdb3-core
    image: influxdb:3-core
    ports:
      - 8181:8181
    environment:
      - AWS_EC2_METADATA_DISABLED=true
      # These might help with TLS issues
      - RUSTLS_TLS_VERIFY=false
      - SSL_VERIFY=false  
    command:
      - influxdb3
      - serve
      - --node-id=${INFLUXDB_NODE_ID}
      - --object-store=s3
      - --bucket=influxdb-data
      - --aws-endpoint=https://minio:9000
      - --aws-access-key-id=<key>
      - --aws-secret-access-key=<secret>
      - --aws-skip-signature	
      
    volumes:
      - ./influxdb_data:/var/lib/influxdb3
      - ./minio.crt:/etc/ssl/certs/minio.crt:ro
     
    healthcheck:
      test: ["CMD-SHELL", "curl -f -H 'Authorization: Bearer ${INFLUXDB_TOKEN}' http://localhost:8181/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

volumes:
influxdb_data:

2

@Tal_Bar-Or There currently isn’t an option that will skip TLS verification when connecting to the object store, however, I have filed a feature request: Support skipping TLS verification when connecting to object storage · Issue #26643 · influxdata/influxdb · GitHub

I see that you are loading in a certificate into the container with:

    volumes:
      - ./influxdb_data:/var/lib/influxdb3
      - ./minio.crt:/etc/ssl/certs/minio.crt:ro

Is this your custom CA’s cert or the server-signed cert? If this is your CA’s cert, once you load it into the environment, you should be able to run the update-ca-certificates command before you start InfluxDB to load the CA in a way that InfluxDB can use it.

3

Thanks ,for the answer , eventually what i did is to extarct the cert from the minio server and created Dockerfile with following code and updated the docker ,works now

Again Thank you

FROM influxdb:3-core

USER 
root

# Copy the self-signed certificate into the container
COPY 
./certs/s3_minio.crt
 
/usr/local/share/ca-certificates/s3_minio.crt

# Update the trusted certificates
RUN 
update-ca-certificates

# Switch back to the default user (if needed)
#USER influxdb
FROM influxdb:3-core


USER root


# Copy the self-signed certificate into the container
COPY ./certs/s3_minio.crt /usr/local/share/ca-certificates/s3_minio.crt


# Update the trusted certificates
RUN update-ca-certificates


# Switch back to the default user (if needed)
#USER influxdb