tls: failed to verify certificate: x509: certificate signed by unknown authority

[wijetnga]

sudo docker run --rm -p 80:4433 -e AWS_ACCESS_KEY_ID="MY-AWS-KEY" -e AWS_SECRET_ACCESS_KEY="MY-AWS-SECRET" -e S3PROXY_ENCRYPT_KEY="GENERATE_A_RANDOM_STRING" -e S3PROXY_HOST="s3.us-west-2.amazonaws.com" -e S3PROXY_DEKTAG_NAME="isec" ghcr.io/intrinsec/s3proxy

output
time="2025-10-02T00:09:44Z" level=info msg=listening ip=0.0.0.0 port=4433 region=eu-west-1
time="2025-10-02T00:09:44Z" level=warning msg="TLS is disabled"

When I do curl I get below error. Any idea? And also how do I change to region=us-west-2

curl --request PUT http://127.0.0.1:80/testbucket
do request: Put "https://s3.us-west-2.amazonaws.com/testbucket": tls: failed to verify certificate: x509: certificate signed by unknown authority

Please help.

[quaternion7]

The ghcr.io/intrinsec/s3proxy image (built from the dockerfile of this repo) does not include CA-certificates.
I made it work by doing some modifications on the dockefile and re-building it:

FROM golang:1.24.5 AS build-stage

WORKDIR /app

ADD go.mod go.sum ./
RUN go mod download

ADD s3proxy ./s3proxy

RUN cd s3proxy/cmd && CGO_ENABLED=0 GOOS=linux go build main.go

# Get CA-certificates from alpine
FROM alpine AS certs
RUN apk update && apk add ca-certificates

# Deploy the application binary into a lean image

FROM busybox:1.36 AS build-release-stage
WORKDIR /app
# ENV AWS_ACCESS_KEY_ID="TEST"
# ENV AWS_SECRET_ACCESS_KEY="TEST"
# ENV S3PROXY_ENCRYPT_KEY="TEST"
# ENV S3PROXY_HOST="TEST"
# ENV S3PROXY_DEKTAG_NAME="isec"

COPY --from=certs /etc/ssl/certs /etc/ssl/certs
COPY --from=build-stage /app/s3proxy/cmd/main /app/isec-s3proxy

EXPOSE 4433
USER 1001
ENTRYPOINT ["/app/isec-s3proxy"]
CMD ["--level=-4", "--no-tls"]

Basically we get the ca-certificates from the alpine image and copy them into the busybox one.

[rivoalrivoal]

Ty @quaternion7
Can you test release 1.7.0 ?

[wijetnga]

Failed to copy http://abc.com:4433/testbucket/expire.txt. Last-Modified time format is invalid, failed with unable to parse in any of the input formats: [Mon, 2 Jan 2006 15:04:05 GMT Mon, _2 Jan 2006 15:04:05 GMT Mon, _2 Jan 06 15:04:05 GMT]

Log
time="2025-10-30T17:51:47Z" level=debug msg=forwarding host="abc.com:4433" method=GET path=/testbucket/
time="2025-10-30T17:51:47Z" level=debug msg=forwarding host="abc.com:4433" method=HEAD path=/testbucket/expire.txt
time="2025-10-30T17:51:47Z" level=debug msg=intercepting host="abc.com:4433" method=GET path=/testbucket/expire.txt
time="2025-10-30T17:51:47Z" level=debug msg=getObject bucket=testbucket key=expire.txt requestID=152f767e-32dd-4d02-97ea-295c47b81e98

[ynsta]

Two separate problems here, both environmental — no proxy fix needed.

1. TLS verify failure

The proxy container does not ship system CA roots, so the AWS SDK inside it cannot validate s3.us-west-2.amazonaws.com's certificate. Mount your host CA bundle in:

docker run --rm -p 80:4433 \
  -v /etc/ssl/certs:/etc/ssl/certs:ro \
  -e AWS_ACCESS_KEY_ID=... \
  -e AWS_SECRET_ACCESS_KEY=... \
  -e S3PROXY_ENCRYPT_KEY=... \
  -e S3PROXY_HOST=s3.us-west-2.amazonaws.com \
  -e S3PROXY_DEKTAG_NAME=isec \
  ghcr.io/intrinsec/s3proxy

2. Region

Default is eu-west-1. Override with the -region CLI flag:

docker run ... ghcr.io/intrinsec/s3proxy -region us-west-2

Can you confirm whether the CA mount + region flag resolves it on your side?