docker unable to navigate to a web site using https

Question

I have the following trivial docker file:

FROM mcr.microsoft.com/windows/servercore:ltsc2019

WORKDIR /azp

COPY test.ps1 .

CMD powershell .\test.ps1

Where test.ps1 is:

C:\test> cat .\test.ps1
curl https://cnn.com -UseBasicParsing

The script can run just fine on my machine, but not in a docker container:

C:\test> docker build -t test:latest .
Sending build context to Docker daemon  75.26kB
Step 1/4 : FROM mcr.microsoft.com/windows/servercore:ltsc2019
 ---> 782a75e44953
Step 2/4 : WORKDIR /azp
 ---> Using cache
 ---> b43270631602
Step 3/4 : COPY test.ps1 .
 ---> Using cache
 ---> 10cfc66cff37
Step 4/4 : CMD powershell .\test.ps1
 ---> Using cache
 ---> 187be18c5495
Successfully built 187be18c5495
Successfully tagged test:latest
C:\test> docker run test
curl : The underlying connection was closed: Could not establish trust
relationship for the SSL/TLS secure channel.
At C:\azp\test.ps1:1 char:1
+ curl https://cnn.com -UseBasicParsing
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:Htt
   pWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
   ll.Commands.InvokeWebRequestCommand

Note that replacing https://cnn.com (https) with http://google.com (http) works, so this is clearly something about the https.

What am I missing?

P.S.

I am using Windows 10 with the most recent docker switched to use windows containers.

Answer 1

So I managed to make it work for https://google.com by following these steps:

1. Navigate to https://google.com and check what is the root certificate. It is a certificate with thumbprint 75E0ABB6138512271C04F85FDDDE38E4B7242EFE
2. Export the aforementioned certificate as well as the ZScaler root certificate (D72F47D87420E3F0F9BDCAC6F03A566743C481B9) to a special directory that will be included in the image under C:\containers.
3. Modify the test.ps1 script - see below.
4. Modify the Dockerfile script - see below.

test.ps1

Get-ChildItem /certificates | ForEach-Object {
    $null = Import-Certificate -FilePath $_.FullName -CertStoreLocation Cert:\LocalMachine\Root
}

$res = Invoke-WebRequest https://google.com -UseBasicParsing
$res.StatusDescription

Dockerfile

FROM mcr.microsoft.com/windows/servercore:ltsc2019
COPY certificates certificates
WORKDIR /azp
COPY test.ps1 .
CMD powershell .\test.ps1

So, on the host machine I run the following commands:

C:\test> $certs = dir Cert:\LocalMachine\Root |? { $_.Thumbprint -eq '75E0ABB6138512271C04F85FDDDE38E4B7242EFE' -or $_.Thumbprint -eq 'D72F47D87420E3F0F9BDCAC6F03A566743C481B9' }
C:\test> $certs


   PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root

Thumbprint                                Subject
----------                                -------
D72F47D87420E3F0F9BDCAC6F03A566743C481B9  [email protected], CN=Zscaler Root CA, OU=Zscaler Inc., O=Zscaler Inc., L=San Jose, S=California, C=US
75E0ABB6138512271C04F85FDDDE38E4B7242EFE  CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2


C:\test> $certs |% { Export-Certificate -FilePath "c:\test\certificates\$($_.Thumbprint).cer" -Cert $_ }


    Directory: C:\test\certificates


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----         1/5/2020   8:40 PM           1239 D72F47D87420E3F0F9BDCAC6F03A566743C481B9.cer
-a----         1/5/2020   8:40 PM            958 75E0ABB6138512271C04F85FDDDE38E4B7242EFE.cer


C:\test> docker run test
OK
C:\test>

Answer 2

It looks like your container is not able to verify TLS server certificate. Probably CA certificates (maybe they have different technical term in the Windows) are missing in the container.

You can:

• -SkipCertificateCheck (available from PowerShell V6.0+), so TLS cert verification will be skipped - good choice for development, but it will sacrifice security partially
• "mount Windows hosts certificate store in container" - Docker forum