Docker can't see SSL key

[ontl]

snap-camera-server-301-webapp-1 is crashing out when I try to run the docker.

2023-04-08 22:21:10 snap-camera-server-301-webproxy-1  | /docker-entrypoint.sh: Configuration complete; ready for start up
2023-04-08 22:21:10 snap-camera-server-301-webproxy-1  | 2023/04/09 02:21:10 [emerg] 1#1: cannot load certificate key "/etc/ssl/private/studio-app.snapchat.com.key": BIO_new_file() failed (SSL: error:02001001:system library:fopen:Operation not permitted:fopen('/etc/ssl/private/studio-app.snapchat.com.key','r') error:2006D002:BIO routines:BIO_new_file:system lib)
2023-04-08 22:21:10 snap-camera-server-301-webproxy-1  | nginx: [emerg] cannot load certificate key "/etc/ssl/private/studio-app.snapchat.com.key": BIO_new_file() failed (SSL: error:02001001:system library:fopen:Operation not permitted:fopen('/etc/ssl/private/studio-app.snapchat.com.key','r') error:2006D002:BIO routines:BIO_new_file:system lib)
1969-12-31 19:00:00 snap-camera-server-301-webproxy-1 exited with code 1

MacOS 12.6.1, ARM.

Cert generation went ok as far as I can tell, and studio-app.snapchat.com.crt has been set to "Always Trust" in Keychain.

Any ideas about what might be going wrong?

[ptrumpis]

Possible reasons:

• Your ssl/ folder is missing the certificate .key file
• Docker does not have permission to access the ssl/ folder

Did you make any changes to your docker-compose.yml file?

[ontl]

Thanks for the quick response!

/Applications/snap-camera-server-3.0.1/ssl has studio-app.snapchat.com.crt (which I installed & trusted in Keychain) and studio-app.snapchat.com.key

I replaced the contents of docker-compose.yml with this because I'm on ARM

Docker app > Settings > Resources > File Sharing has /Applications/snap-camera-server-3.0.1 added

Anything else I can check on?

[ptrumpis]

What is the output of ls -la /Applications/snap-camera-server-3.0.1/ssl

You may have to adjust the file permissions

[ontl]

total 16
drwxrwxr-x@  5 nick  staff   160  8 Apr 21:36 .
drwxrwxr-x@ 25 nick  staff   800  8 Apr 21:43 ..
-rw-rw-r--@  1 nick  staff     0 24 Mar 10:08 .gitkeep
-rw-r--r--   1 root  staff  1314  8 Apr 21:36 studio-app.snapchat.com.crt
-rw-------   1 root  staff  1704  8 Apr 21:36 studio-app.snapchat.com.key

Is that right or does the .key need to be loosened up to match .crt?

[ptrumpis]

try sudo chown -R root:root /Applications/snap-camera-server-3.0.1/ssl/*

[ontl]

chown: root: illegal group name

[ptrumpis]

Ok what about? sudo chown -R nick:staff /Applications/snap-camera-server-3.0.1/ssl/*

To match the other files.

Docker will copy the files but it's hard to tell how it manages the permissions
If it doesn't work, you could also try an older nginx image like 1.22

  webproxy:
    image: nginx:1:22

[ontl]

Hero! Thanks