cosign with nexus using self signed certificate: x509: certificate is valid for connaisseur-svc ....

[joelapatatechaude]

Hi there,
I could sign (cosign) some images in my nexus.test.com:5000 self hosted registry that is using a self signed certificate. I can verify with cosign on my laptop. Now I would like to verify it in the kubernetes cluster using connaisseur.
Unfortunately, I am getting this

x509: certificate is valid for connaisseur-svc .... connaisseur-svc.connaisseur.svc.cluster.local, not nexus.test.com

I think I need to provide the root cert used to generate the nexus.test.com cert, can't find a way to do that within the values.yaml. There is this cert: | section under the cosign validators I configured, but I didn't get much luck using it.

[xopham]

Hi @joelapapatechaude 👋
When do you get the error? When trying to deploy a cosign-signed image?
The cert flag is only used for notary v1 signed images with a self-signed notary. On your local machine, did you have to provide the cert to cosign in some way?
Also, which cosign version are you using and could you share your helm/values.yaml and the way you are deploying the image to understand the situation better?

[joelapatatechaude]

Hello @xopham,
Thanks for your answer.
I get the error when deploying a cosign-signed or unsigned docker image with kubectl run. I installed the CA certificate in my machine to get nexus https to work correctly. As a consequence, signing or verifying with cosign binary works fine from localhost. Now, when I added a docker sign step in my gitlab pipeline, cosign (running from a container) wouldn't sign until I installed the CA cert in the container in which cosign is running. So I guess I have to install the CA cert somehow in the connaisseur container? Is there a native way to do that with values.yaml? Otherwise any hint on the usual way to achieve that with kubernetes / helm?

I signed with cosign 1.2.1. I see that securesystemsengineering/connaisseur:v2.1.2 is using cosign v1.0.0

the helm/values.yaml is the default one with the modifications indicated in the guide https://sse-secure-systems.github.io/connaisseur/v2.1.2/getting_started/#configure-connaisseur (cosign tabs)
So the only changes happened in the validators section under the default validator:

validators:
# static validator that allows each image
- name: allow
  type: static
  approve: true
# static validator that denies each image
- name: deny
  type: static
  approve: false
# the `default` validator is used if no validator is specified in image policy
- name: default
  #type: notaryv1  # or other supported validator (e.g. "cosign")
  type: cosign  # or other supported validator (e.g. "cosign")
  #host: notary.docker.io # in case of notaryv1, configure the notary server to be used
  trust_roots:
  # # the `default` key is used if no key is specified in image policy
  - name: default
    key: |  # enter your public key below
      -----BEGIN PUBLIC KEY-----
      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1/jy91pG5vYqaIhaic7E1e2CeF5B
      cP/npOI9PGEyi/26cot6XDWAMZZrONtf0IUcfYBu8m67LZiiUfYd/YPesQ==
      -----END PUBLIC KEY-----
  #cert: |  # in case the trust data host is using a self-signed certificate
  #  -----BEGIN CERTIFICATE-----
  #  ...
  #  -----END CERTIFICATE-----
  #auth:  # credentials in case the trust data requires authentication
  #  # either (preferred solution)
  #  secret_name: mysecret  # reference a k8s secret in the form required by the validator type (check the docs)
  #  # or (only for notaryv1 validator)
  #  username: myuser
  #  password: mypass
# pre-configured nv1 validator for public notary from Docker Hub
- name: dockerhub_basics
# etc....

[xopham]

@joelapapatechaude nice! Seems like we have found the actual problem. I have created issue #324 for that.
I am not yet sure how to best solve that and will have to look into it myself. Maybe install the cert in the connaisseur container or provide it somehow via k8s.

Feel free to contribute if you find a solution first. We are happy about any support 🙏

[joelapatatechaude]

Sounds good. I'll post a workaround once I find the easiest way to add those certs in kubernetes container.

[xopham]

Awesome! Much appreciated 🙏