minio+KMS x509:由未知颁发机构签署的证书

Question

我正在尝试使用minio作为本地S3服务器。我正在关注这个article

我下载了密钥和证书文件。我添加了env参数：

set MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373
set MINIO_KMS_KES_KEY_FILE=D:\KMS\root.key
set MINIO_KMS_KES_CERT_FILE=D:\KMS\root.cert
set MINIO_KMS_KES_KEY_NAME=my-minio-key

我启动了微型服务器：D:\>minio.exe server D:\Photos It logs after sturt up：

Endpoint:  http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000           
AccessKey: minioadmin
SecretKey: minioadmin

Browser Access:
   http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000                   

Command-line Access: https://docs.min.io/docs/minio-client-quickstart-guide
   $ mc.exe alias set myminio http://169.254.182.253:9000 minioadmin minioadmin

Object API (Amazon S3 compatible):
   Go:         https://docs.min.io/docs/golang-client-quickstart-guide
   Java:       https://docs.min.io/docs/java-client-quickstart-guide
   Python:     https://docs.min.io/docs/python-client-quickstart-guide
   JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
   .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin', please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'

我在browser：http://localhost:9000/minio/mybacket/中打开了UI，我试图上传一个jpg文件，但得到了一个异常：

<?xml version="1.0" encoding="UTF-8"?> <Error><Code>InternalError</Code><Message>We encountered an internal error, please try again.</Message><Key>Completed.jpg</Key><BucketName>mybacket</BucketName><Resource>/minio/upload/mybacket/Completed.jpg</Resource><RequestId>1634A6E5663C9D70</RequestId><HostId>4a46a947-6473-4d53-bbb3-a4f908d444ce</HostId></Error>

我在minio控制台中得到了这个异常：

Error: Post "https://play.min.io:7373/v1/key/generate/my-minio-key": x509: certificate signed by unknown authority
       3: cmd\api-errors.go:1961:cmd.toAPIErrorCode()
       2: cmd\api-errors.go:1986:cmd.toAPIError()
       1: cmd\web-handlers.go:1116:cmd.(*webAPIHandlers).Upload()

Answer 1

很可能您的OS信任存储(包含根CA证书)不信任“让我们加密”(“让我们加密机构X3 CA证书”)。

服务器https://play.min.io:7373提供由Let's Encrypt颁发的TLS证书。请参见：

openssl s_client -showcerts -servername play.min.io -connect play.min.io:7373

最后，检查windows计算机的根CA存储区。

请参阅：https://security.stackexchange.com/questions/48437/how-can-you-check-the-installed-certificate-authority-in-windows-7-8