step ssh config x509: certificate signed by unknown authority

[praveenraghav01]

I am following the step mentioned on https://smallstep.com/blog/diy-single-sign-on-for-ssh/
CA setup is completed but i am getting error while configuring Host.

$ step ca bootstrap --ca-url $CA_URL  --fingerprint $CA_FINGERPRINT
The root certificate has been saved in /root/.step/certs/root_ca.crt.
Your configuration has been saved in /root/.step/config/defaults.json.

is working fine but step ssh config --roots is giving errors

$ step ssh config --roots
error getting ssh public keys: client GET https://ca.stagingsimpl.com/ssh/roots failed: Get "https://ca.stagingsimpl.com/ssh/roots": x509: certificate signed by unknown authority

my CA instance is behind an Application load balancer

[hslatman]

Hi @praveenraghav01,

Are you using L4 or L7 load balancing on your application load balancer? A likely cause for the error you're seeing is that the load balancer is using a certificate not signed by your step-ca root CA. The step CLI verifies certificate chains using the root CA cert stored in /root/.step/certs/root_ca.crt, which it fails to do now. The bootstrap command works, because it intentionally connects using a non-TLS HTTP connection.

If you need load balancing, we generally advise to use L4 load balancing, so that TLS is terminated by step-ca and not by the load balancer. Some more information about that is available here: https://smallstep.com/docs/step-ca/certificate-authority-server-production#load-balancing-or-proxying-step-ca-traffic.

If L4 load balancing is not an option, you could look into providing the load balancer a certificate signed by your root CA, so that step can successfully verify the chain. If that's also not possible, you should find out what certificate the load balancer is serving from and if it's signed by a different CA. You could add the root of that other CA to the roots that step trusts (in /root/.step/certs/root_ca.crt), so that the chain can be verified. Both of these solutions may cause certain functionality of step-ca to not work out of the box or not at all, because we heavily rely on TLS, but it may be acceptable for your use case.

[praveenraghav01]

Thank you for the help using L4 load balancing helps