aspnet:8.0-jammy-chiseled-extra - Issue with sqlserver/openssl.cnf

[wbtholl]

Hello - we are running into an openssl issue with our sql server connection when trying to use the aspnet:8.0-jammy-chiseled-extra image. We have a dependency on an old version of SqlServer so we must modify the openssl.cnf to downgrade the security level. I have produce a Dockerfile which does this successfully when using aspnet:8.0-jammy as the base image, but the openssl.cnf change does not apply when using aspnet:8.0-jammy-chiseled-extra as the base image. I've built this docker file based on suggestions from a similar issue with an earlier chiseled image, but I've updated the openssl fix for net8 based on other threads. Any suggestions or ideas as to what might fix the issue in the chiseled version?

Here is the docker file I have been using, and the only change I am making between a working and non-working version is using the aspnet:8.0-jammy-chiseled-extra (not working) -vs- aspnet:8.0-jammy (working) in the final stage.
DOCKERFILE:

FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS build
WORKDIR /src
COPY . .

# Install Credential Provider and set env variables to enable Nuget restore with auth
ARG PAT
RUN wget -qO- https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash
ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS "{\"endpointCredentials\": [{\"endpoint\":\"https://pkgs.dev.azure.com/ourprivaterepo/_packaging/SysDev/nuget/v3/index.json\", \"password\":\"${PAT}\"}]}"

RUN dotnet restore "src/RecIdServiceMin.Api/RecIdServiceMin.Api.csproj" --configfile "src/RecIdServiceMin.Api/NuGet.config"

# allow weak certificates (certificate signed with SHA1)
# by downgrading OpenSSL security level from 2 to 1 
RUN sed -i 's/\[openssl_init\]/# [openssl_init]/' /etc/ssl/openssl.cnf
RUN printf "\n\n[openssl_init]\nssl_conf = ssl_sect" >> /etc/ssl/openssl.cnf
RUN printf "\n\n[ssl_sect]\nsystem_default = ssl_default_sect" >> /etc/ssl/openssl.cnf
RUN printf "\n\n[ssl_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=0\n" >> /etc/ssl/openssl.cnf

RUN dotnet publish "src/RecIdServiceMin.Api/RecIdServiceMin.Api.csproj" -c Release -o /app -r linux-x64

#final stage
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-extra
COPY --from=build /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
WORKDIR /app
COPY --from=build /app .

EXPOSE 8080
USER $APP_UID
ENV TZ="America/New_York"
ENTRYPOINT ["dotnet", "RecIdServiceMin.Api.dll"]

[akoken]

Hi,

The following configuration worked in my case.

FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS build

RUN sed -i 's/DEFAULT:@SECLEVEL=2/ALL:@SECLEVEL=0/g' /etc/ssl/openssl.cnf
RUN sed -i 's/DEFAULT:@SECLEVEL=2/ALL:@SECLEVEL=0/g' /usr/lib/ssl/openssl.cnf

...
WORKDIR /src
...

FROM base AS final
 
COPY --from=build /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
COPY --from=build /usr/lib/ssl/openssl.cnf /usr/lib/ssl/openssl.cnf
 
WORKDIR /app
COPY --from=build /app/publish .
...

[wbtholl]

Thanks for this. It didn't exactly work for me, but got me on the right track -- needed the /usr/lib/ssl/openssl.cnf addition.

I needed this:

FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS build

RUN sed -i 's/\[openssl_init\]/# [openssl_init]/' /etc/ssl/openssl.cnf
RUN printf "\n\n[openssl_init]\nssl_conf = ssl_sect" >> /etc/ssl/openssl.cnf
RUN printf "\n\n[ssl_sect]\nsystem_default = ssl_default_sect" >> /etc/ssl/openssl.cnf
RUN printf "\n\n[ssl_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=0\n" >> /etc/ssl/openssl.cnf

RUN sed -i 's/\[openssl_init\]/# [openssl_init]/' /usr/lib/ssl/openssl.cnf
RUN printf "\n\n[openssl_init]\nssl_conf = ssl_sect" >> /usr/lib/ssl/openssl.cnf
RUN printf "\n\n[ssl_sect]\nsystem_default = ssl_default_sect" >> /usr/lib/ssl/openssl.cnf
RUN printf "\n\n[ssl_default_sect]\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=0\n" >> /usr/lib/ssl/openssl.cnf

WORKDIR /src
COPY . .
...

FROM base AS final
COPY --from=build /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
COPY --from=build /etc/ssl/openssl.cnf /usr/lib/ssl/openssl.cnf

WORKDIR /app
COPY --from=publish /app/publish .
...

[akoken]

Glad that you solved it. I remember that I tried hard back then. openssl.cnf can vary between Linux distributions. Most likely '/usr/lib/ssl/openssl.cnf' is symlinked of /etc/ssl/openssl.cnf'. You can verify that by using ls -lah /usr/lib/ssl.