Private cloud solution with internal domain SSL issues

Question

How to attack this issue with Web Connector? We have in our private cloud a reporting solution and this one as an API I can invoke. This one has been placed behind a reverse proxy with a local domain report.app.lef. Now I get this error (indicium 2025.3). I'm assuming this is due to the fact that it's signed with out own Root CA? If so, how do I make Indicium trust our CA?

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: PartialChain
   at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem)
   at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at Indicium.Shared.ProcessFlows.SystemActions.WebConnector.sendRequest(WebConnectionConfiguration webConnectionConfiguration, HttpClient httpClient, HttpRequestMessage requestMessage, WebConnectionEndpoint endpoint) in C:\azp\agent\_work\1\s\src\Indicium.Shared\ProcessFlows\SystemActions\WebConnector.cs:line 600

Page 1 / 1

Hi Freddy,

The issue is indeed related to SSL validation - In this case, Indicium does not trust the Root CA that signed your internal certificate.

You can verify this by calling the same endpoint using curl from the Indicium host. It should show a similar SSL error.

To resolve this, you need to add your Root CA certificate to the system certificate store. How that works depends a bit on your Linux distribution (you were using Linux right?).

You can also look into using Lets Encrypt - because the certificate would be valid and the root ca will be known by your system.

Regards,

Dick van den Brink

@Dick van den Brink thanks for the reply. This I understand. I use indicium container from your registry, so I would like to see a future proof solution where I can attach my CA to the container, without manually going into the container and installing the certificate. Maybe @Leon Kroon has an idea?

Dick van den Brink · Answer

Hi Freddy,The issue is indeed related to SSL validation - In this case, Indicium does not trust the Root CA that signed your internal certificate.You can verify this by calling the same endpoint using curl from the Indicium host. It should show a similar SSL error.To resolve this, you need to add your Root CA certificate to the system certificate store. How that works depends a bit on your Linux distribution (you were using Linux right?).You can also look into using Lets Encrypt - because the certificate would be valid and the root ca will be known by your system.Regards,Dick van den Brink

Sign up

Login to the Thinkwise Software Community

Scanning file for viruses.

This file cannot be downloaded