minio + KMS x509：未知授权机构签署的证书

问题描述

我正在尝试将minio用作本地S3服务器。我正在关注此article

我下载了密钥和证书文件。我添加了env参数：

set MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373
set MINIO_KMS_KES_KEY_FILE=D:\KMS\root.key
set MINIO_KMS_KES_CERT_FILE=D:\KMS\root.cert
set MINIO_KMS_KES_KEY_NAME=my-minio-key

我启动了微型服务器：D:\>minio.exe server D:\Photos 结实后记录：

Endpoint:  http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000           
AccessKey: minioadmin
SecretKey: minioadmin

browser Access:
   http://169.254.182.253:9000  http://169.254.47.198:9000  http://172.17.39.193:9000  http://192.168.0.191:9000  http://169.254.103.105:9000  http://169.254.209.102:9000  http://169.254.136.71:9000  http://127.0.0.1:9000                   

Command-line Access: https://docs.min.io/docs/minio-client-quickstart-guide
   $ mc.exe alias set myminio http://169.254.182.253:9000 minioadmin minioadmin

Object API (Amazon S3 compatible):
   Go:         https://docs.min.io/docs/golang-client-quickstart-guide
   Java:       https://docs.min.io/docs/java-client-quickstart-guide
   Python:     https://docs.min.io/docs/python-client-quickstart-guide
   JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
   .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin',please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'

我在浏览器中打开了UI：http：// localhost：9000 / minio / mybacket / 我尝试上传jpg文件，但出现异常：

<?xml version="1.0" encoding="UTF-8"?> <Error><Code>InternalError</Code><Message>We encountered an internal error,please try again.</Message><Key>Completed.jpg</Key><BucketName>mybacket</BucketName><Resource>/minio/upload/mybacket/Completed.jpg</Resource><RequestId>1634A6E5663C9D70</RequestId><HostId>4a46a947-6473-4d53-bbb3-a4f908d444ce</HostId></Error>

我在minio控制台中遇到了这个异常：

Error: Post "https://play.min.io:7373/v1/key/generate/my-minio-key": x509: certificate signed by unkNown authority
       3: cmd\api-errors.go:1961:cmd.toAPIErrorCode()
       2: cmd\api-errors.go:1986:cmd.toAPIError()
       1: cmd\web-handlers.go:1116:cmd.(*webAPIHandlers).Upload()

解决方法

您的OS信任库（包含根CA证书）很可能不信任Let's Encrypt（Let's Encrypt Authority X3 CA证书）。

服务器https://play.min.io:7373提供由Let's Encrypt发行的TLS证书。参见：

openssl s_client -showcerts -servername play.min.io -connect play.min.io:7373

最终，检查Windows计算机的根CA存储。
参见：https://security.stackexchange.com/questions/48437/how-can-you-check-the-installed-certificate-authority-in-windows-7-8

aws-kms minio