Error when creating OIDC provisioner: "certificate signed by unknown authority"

[jorti]

I'm trying to configure a OIDC provisioner using my Authelia server:

$ step ca provisioner add Authelia --type oidc --client-id ID --client-secret "SECRET" --configuration-endpoint "https://auth.example.com"  --admin-subject=step --admin-provisioner=admin

error storing provisioner Authelia: error validating configuration for provisioner "Authelia": failed to connect to https://auth.example.com/.well-known/openid-configuration: Get "https://auth.example.com/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority

auth.example.com is using a valid Letsencrypt certificate as it's a service publicly accessible. Step CA is running as a container using the image docker.io/smallstep/step-ca:hsm.

I'd expect that step has trust in the root CA certificates when connecting to a OIDC server. Am I doing something wrong? or is this a bug?

[tashian]

@jorti I believe CA certificates are not baked into our container images. So, try installing the CA certificates package in the container.

[hslatman]

fyi @tashian: #2433