From 3ba76089a50b03ac05f8d6b2938aba8ee8a02d9f Mon Sep 17 00:00:00 2001 From: Calvin Cheng Date: Mon, 15 Jun 2026 12:15:04 -0400 Subject: [PATCH] Bump up proxy_ssl_verify_depth from 2 to 3, to handle intermediate certificates --- entrypoint.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index 4c7de01..0e581c3 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -281,7 +281,9 @@ if [[ "a${VERIFY_SSL}" == "atrue" ]]; then # We'll accept any cert signed by a CA trusted by Mozilla (ca-certificates-bundle in alpine) proxy_ssl_verify on; proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; - proxy_ssl_verify_depth 2; + # docker.io has changed their certificate chain to include another intermediate certificate, + # original value of 2 is not enough, bump up depth to 3. + proxy_ssl_verify_depth 3; EOD echo "Upstream SSL certificate verification enabled." else