Getting TLS with STIGMAN and MySQL

[jace5869]

I have been banging my head against a wall following:
https://stig-manager.readthedocs.io/en/1.5.3/installation-and-setup/db.html

I've gotten x509 cac login working with ldap and doing some simple load balancing with nginx but getting TLS working on MySQL and STIGMAN are proving to be an issue.

I am getting this error:

{"date":"2025-05-09T09:30:12.264Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:30:17.281Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:30:22.295Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:30:27.311Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:30:32.322Z","level":1,"component":"dependencies","type":"shutdown","data":{"message":"Failed to setup dependencies","error":{"message":"self-signed certificate in certificate chain","code":"HANDSHAKE_SSL_ERROR","name":"Error","stack":"Error: self-signed certificate in certificate chain\n at PromisePool.query (/home/node/node_modules/mysql2/promise.js:356:22)\n at module.exports.testConnection (/home/node/service/utils.js:17:35)\n at RetryOperation.runAttempt [as _fn] (/home/node/node_modules/async-retry/lib/index.js:42:15)\n at Timeout._onTimeout (/home/node/node_modules/retry/lib/retry_operation.js:85:10)\n at listOnTimeout (node:internal/timers:569:17)\n at process.processTimers (node:internal/timers:512:7)"}}} {"date":"2025-05-09T09:42:04.569Z","level":3,"component":"bootstrapUtils","type":"starting bootstrap","data":{"version":"1.5.5","env":{"STIGMAN_DB_PASSWORD":"*","NODE_EXTRA_CA_CERTS":"/tmp/dod-certs.pem","NODE_VERSION":"18.20.7","STIGMAN_DB_HOST":"stigman-fqdn.com","STIGMAN_DB_USER":"stigman","STIGMAN_DB_TLS_CERT_FILE":"server-db.pem","STIGMAN_TLS":"true","STIGMAN_API_BASE":"/api","STIGMAN_DB_TLS_KEY_FILE":"server-db.key","STIGMAN_CLIENT_OIDC_PROVIDER":"https://stigman-fqdn.com/realms/stigman","STIGMAN_CLASSIFICATION":"U","STIGMAN_SWAGGER_ENABLED":"true","STIGMAN_CLIENT_DIRECTORY":"./client","STIGMAN_OIDC_PROVIDER":"http://stigman-fqdn.com:8080/realms/stigman","STIGMAN_DOCS_DIRECTORY":"./docs"},"dirname":"/home/node/bootstrap","cwd":"/home/node"}} {"date":"2025-05-09T09:42:04.570Z","level":3,"component":"bootstrapUtils","type":"configuration","data":{"version":"1.5.5","commit":{"branch":"unspecified","sha":"unspecified","tag":"unspecified","describe":"unspecified"},"settings":{"setClassification":"U","lastAccessResolution":60,"responseValidation":"none"},"client":{"clientId":"stig-manager","displayAppManagers":"true","authority":"https://stigman-fqdn.com/realms/stigman","apiBase":"api","disabled":false,"directory":"./client","refreshToken":{"disabled":false},"welcome":{"image":"","message":"","title":"","link":""}},"docs":{"disabled":false,"docsDirectory":"./docs"},"http":{"address":"0.0.0.0","port":54000,"maxJsonBody":"31457280","maxUpload":"1073741824"},"database":{"host":"stigman-fqdn.com","port":3306,"schema":"stigman","username":"stigman","maxConnections":25,"tls":{"cert_file":"server-db.pem","key_file":"server-db.key"},"revert":false,"password":true},"swaggerUi":{"enabled":true,"authority":"http://stigman-fqdn.com:8080/realms/stigman","server":"http://localhost:54000/api","oauth2RedirectUrl":"http://localhost:54000/api-docs/oauth2-redirect.html"},"oauth":{"authority":"http://stigman-fqdn.com:8080/realms/stigman","claims":{"scope":"scope","name":"name","privileges":"\"realm_access\".\"roles\"","privilegesChain":"['realm_access']?.['roles']","email":"email","assertion":"jti"}},"log":{"level":3,"mode":"combined","optStats":false},"experimental":{"appData":false}}} {"date":"2025-05-09T09:42:04.571Z","level":3,"component":"middleware","type":"bootstrap","data":{"message":"configuring middleware"}} {"date":"2025-05-09T09:42:04.578Z","level":3,"component":"middleware","type":"bootstrap","data":{"message":"middleware configured"}} {"date":"2025-05-09T09:42:04.646Z","level":3,"component":"server","type":"listening","data":{"port":54000,"api":"/api","client":"/","documentation":"/docs","swagger":"/api-docs"}} {"date":"2025-05-09T09:42:05.081Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:05.090Z","level":3,"component":"oidc","type":"discovery","data":{"success":true,"metadataUri":"http://stigman-fqdn.com:8080/realms/stigman/.well-known/openid-configuration","jwksUri":"http://stigman-fqdn.com:8080/realms/stigman/protocol/openid-connect/certs"}} {"date":"2025-05-09T09:42:10.091Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:15.102Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:20.120Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:25.134Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:30.152Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:35.161Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:40.178Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:45.194Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:50.207Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:42:55.221Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:00.240Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:05.250Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:10.266Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:15.278Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:20.298Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:25.315Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}} {"date":"2025-05-09T09:43:30.332Z","level":1,"component":"mysql","type":"preflight","data":{"success":false,"message":"self-signed certificate in certificate chain"}}

[jace5869]

`mysql:
image: docker.io/library/mysql:latest
environment:
- MYSQL_ROOT_PASSWORD=rootpw
- MYSQL_USER=stigman
- MYSQL_DATABASE=stigman
- MYSQL_PASSWORD=stigmanpw
#- MYSQL_AUTHENTICATION_PLUGIN=mysql_native_password
command:
- --innodb-buffer-pool-size=16G
- --sort_buffer_size=64M
- --ssl-cert=/mysql-certs/server.crt
- --ssl-key=/mysql-certs/server.key
- --ssl-ca=/mysql-certs/dod-ca.pem
- --require_secure_transport=on
volumes:
- /podman/stigman/mysql:/var/lib/mysql:Z
- /podman/stigman/mysql/tmp:/tmp:Z
- /podman/stigman/certs/mysql/stigman.fqdn.crt:/mysql-certs/server.crt:Z
- /podman/stigman/certs/mysql/stigman.fqdn.key:/mysql-certs/server.key:Z
- /podman/stigman/certs/mysql/dod_CAs.pem:/mysql-certs/dod-ca.pem:Z
#- /podman/stigman/mysql/tls/tls.cnf:/etc/mysql/conf.d/tls.cnf:Z
ports:
- "3306:3306"
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "--password=rootpw"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s

  stigman:
image:  registry1.dso.mil/ironbank/opensource/stig-manager/stig-manager:1.5.5
depends_on:
  mysql:
    condition: service_healthy
environment:
  - STIGMAN_OIDC_PROVIDER=http://stigman.fqdn:8080/realms/stigman
  - STIGMAN_CLIENT_OIDC_PROVIDER=https://stigman.fqdn/realms/stigman
  - STIGMAN_CLASSIFICATION=U
  - STIGMAN_DB_HOST=stigman.fqdn
  - STIGMAN_DB_USER=stigman
  - STIGMAN_DB_PASSWORD=stigmanpw
  - NODE_EXTRA_CA_CERTS=/tmp/dod-certs.pem
  - STIGMAN_SWAGGER_ENABLED=true
  - STIGMAN_API_BASE=/api
  - STIGMAN_TLS=true
  - STIGMAN_DB_TLS_CERT_FILE=server-db.pem
  - STIGMAN_DB_TLS_KEY_FILE=server-db.key
  - STIGMAN_DB_TLS_CA_FILE=dod-ca.pem
init: true
volumes:
  - /podman/stigman/certs/dod/stigman-dod-certs.pem:/tmp/dod-certs.pem:Z
  - /podman/stigman/certs/stigman/:/home/node/tls/:Z
  #- /podman/stigman/certs/stigman/stigman.fqdn.key:/home/node/tls/server.key:Z
  #- /podman/stigman/certs/stigman/dod_CAs.pem:/home.node/tls/dod-ca.pem:Z
ports:
  - "54000:54000"
    #healthcheck:
    #test: ["CMD", "curl", "--fail", "http://localhost:54000 || exit 1"]
    #interval: 20s
    #timeout: 5s
    #retries: 5
    #start_period: 45s

`

[jace5869]

So scratch that

I was trying to use a tls.cnf file and apparently it wasn't setting things or it was getting overwritten.