TLS Failed to Verify Certificate: Connecting to ACR Registry using Private Endpoint ADO Pipeline

TLS Failed Verify Certificate: Connecting ACR Registry using Private Endpoint ADO Pipeline

This article aims to provide a detailed context on the issue of TLS failed verify certificate when connecting to an Azure Container Registry (ACR) registry using a private endpoint and Azure DevOps (ADO) pipeline. It covers the key concepts, possible causes, and solutions related to this problem. The content is organized using subtitles, paragraphs, and code blocks where necessary.

Understanding the Components

Before diving into the issue itself, let's start by understanding the components involved:

• Azure Container Registry (ACR): ACR is a managed Docker registry service for storing and managing container images in the Azure cloud.
• Private Endpoint: A private endpoint in Azure is a network interface that connects to a service over a private link. It provides secure and direct access to the service without exposing it to the public internet.
• Azure DevOps (ADO) Pipeline: ADO is a cloud service for developing and deploying software. Pipelines are a key part of ADO, enabling continuous integration (CI) and continuous delivery (CD) workflows.

TLS Failed Verify Certificate Error

The TLS failed verify certificate error occurs when the ADO pipeline attempts to connect to the ACR registry via a private endpoint but encounters issues validating the certificate.

Possible Causes

• Certificate not trusted: The certificate provided by the ACR registry is not trusted or has not been added to the trusted root certificates in the ADO agent.
• Incorrect DNS resolution: There may be issues with the DNS resolution of the private endpoint's FQDN.
• Firewall or network restrictions: Firewall or network restrictions might prevent the ADO agent from connecting to the ACR registry.

Solving the TLS Failed Verify Certificate Error

Let's explore the possible solutions based on the above causes:

Trusting the Certificate

Ensure that the certificate provided by the ACR registry is added to the trusted root certificates in the ADO agent:

1. Export the ACR registry certificate to a file:
az acr login --name openssl s_client -showcerts -connect .azurecr.io:443

Save the certificate from the -----BEGIN CERTIFICATE----- line to the -----END CERTIFICATE----- line to a file (e.g., acr-cert.crt).

2. Import the certificate to the ADO agent:
1. Add the certificate to the local trusted certificate store (in this example, using Windows):
certutil -addstore -enterprise Root acr-cert.crt
1. If using a Linux-based ADO agent, use the update-ca-certificates command:
sudo update-ca-certificates

Correcting DNS Resolution

Verify and correct the DNS resolution configuration:

1. Check the DNS resolution of the private endpoint's FQDN:
nslookup

2. Make necessary adjustments to the ADO agent's DNS settings (e.g., update DNS servers, configure custom DNS settings).

Removing Firewall or Network Restrictions

Verify and update any firewall or network restrictions:

1. Ensure that the ADO agent is allowed to communicate with the ACR registry's private endpoint.
1. Check and update the Azure Firewall or Network Security Group rules if necessary.
1. Verify that there are no additional firewall or network restrictions in the on-premises network or other third-party services.

• Key Concepts: Azure Container Registry, Private Endpoint, Azure DevOps Pipeline, and TLS Failed Verify Certificate.
• Potential Solutions: Trusting the Certificate, Correcting DNS Resolution, and Removing Firewall or Network Restrictions.

References

• Type: Article
  Title: Azure Container Registry (ACR)
• Type: Article
  Title: Private Endpoints
• Type: Article
  Title: Azure DevOps Pipelines