Cannot deploy or login to Caprover because certificate verification error

[mjmare]

I have installed CR with the default Letsencrypt certificate generation. This worked fine. However due to company policy I have had to move to a wildcard certificate. I have installed the new cert for my apps and the CR UI (through the Nginx config overrides in the UI). This works; I can see the new cert is used.
However deploying an app failed. I therefore logged out of my CR instance and trie to login again:

Login to a CapRover machine...

? CapRover machine URL address, it is "[http[s]://][captain.]your-captain-root.domain": https://captain.xxx.yyy.nl
? CapRover machine password: [hidden]
? CapRover machine name, with whom the login credentials are stored locally: captain-01

Something bad happened: cannot save captain-01 at https://captain.xxx.yyy.nl.
Error: unable to verify the first certificate

Any suggestions? TIA

[githubsaturn]

Can you access https://captain.xxx.yyy.nl from your terminal?

Does this work?

curl -Iv https://captain.xxx.yyy.nl

[mjmare]

It seems to work:

❯ curl -Iv https://captain.xxx.yyy.nl
*   Trying 10.2.22.40:443...
* Connected to captain.xxx.yyy.nl (10.2.22.40) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.xxx.yyy.nl
*  start date: May  2 00:00:00 2023 GMT
*  expire date: May  2 23:59:59 2024 GMT
*  subjectAltName: host "captain.xxx.yyy.nl" matched cert's "*.xxx.yyy.nl"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: HEAD]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: captain.xxx.yyy.nl]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x7fe56e80c400)
> HEAD / HTTP/2
> Host: captain.xxx.yyy.nl
> user-agent: curl/7.88.1
> accept: */*
>
< HTTP/2 200
HTTP/2 200
< server: nginx
server: nginx
< date: Thu, 22 Jun 2023 12:54:22 GMT
date: Thu, 22 Jun 2023 12:54:22 GMT
< content-type: text/html; charset=UTF-8
content-type: text/html; charset=UTF-8
< content-length: 2172
content-length: 2172
< x-powered-by: Express
x-powered-by: Express
< accept-ranges: bytes
accept-ranges: bytes
< cache-control: public, max-age=0
cache-control: public, max-age=0
< last-modified: Sun, 10 Oct 2021 04:10:44 GMT
last-modified: Sun, 10 Oct 2021 04:10:44 GMT
< etag: W/"87c-17c686555a0"
etag: W/"87c-17c686555a0"

<
* Connection #0 to host captain.xxx.yyy.nl left intact

[githubsaturn]

Hmmm... that is extremely bizarre - all CapRover CLI does is to call that URL, but instead of curl it uses a NodeJS library

[mjmare]

If I deploy the same app to another Caprover instance (with another domain name) it works fine.
It seems to be related to the switch from the Let’s Encrypt certificate to the custom certificate. Could Node cache the old certificate perhaps?

[githubsaturn]

Very unlikely. I suggest trying another machine from another network to see if you can reproduce the issue...

[mjmare]

Already did in the mean time: same result, unfortunately.

[githubsaturn]

Do you mind sharing your URL? If you want, feel free to share it privately with me info at caprover.

[mjmare]

Sure, just sent you an email.

[mjmare]

Maybe useful for others:
There seems to be an issue with the handling of certain certificates by Node. Therefore the Caprover CLI gives an error.
The best way is to fix the certificate chain. But if you are unable to, and in a relatively safe environment the following (unsafe) workaround may be useful:

NODE_TLS_REJECT_UNAUTHORIZED=0 caprover login

Thanks to Kasra from Caprover for the help!