# Kong API Gateway SSL/TLS Certificates

**URL:** <https://discuss.konghq.com/t/kong-api-gateway-ssl-tls-certificates/10105>\
**Category:** General\
**Tags:** kong-gateway\
**Created:** [April 26, 2022, 2:03am UTC](https://discuss.konghq.com/t/kong-api-gateway-ssl-tls-certificates/10105 "2022-04-26T02:03:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rbessembe](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/rbessembe/32/2802_2.png) [@rbessembe](https://discuss.konghq.com/u/rbessembe)\
**Post date:** [April 26, 2022, 2:03am UTC](https://discuss.konghq.com/t/kong-api-gateway-ssl-tls-certificates/10105/1 "2022-04-26T02:03:06Z")

</div>

Hi everyone!  
I got a problem with SSL/TLS Termination on Kong API Gateway. HTTPS Requests using curl and Insomnia got response that **SSL certificate problem: unable to get local issuer certificate**. **Certificate is valid** and issued by well known issuer, so CA certificate is already in the clients known CA list. In Browser HTTPS requests works fine.

I’m using **Kong version 2.7.1**

**docker-compose.yaml** configured in next way:

```auto
 kong:
    image: kong:2.7.1
    container_name: kong-api-gw
    restart: always
    networks:
      kong-net:
        ipv4_address: 172.16.1.11
    volumes:
      - kong-volume:/etc/kong
      - kong-volume-conf:/usr/local/kong
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_DATABASE: kong
      KONG_PG_USER: ${KONG_PG_USER}
      KONG_PG_PASSWORD: ${KONG_PG_PASSWORD}
      KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
      KONG_ADMIN_LISTEN: 0.0.0.0:8001, 0.0.0.0:8444 ssl
      KONG_SSL: "on"
      KONG_SSL_CERT: /etc/kong/ssl/mycert.crt
      KONG_SSL_CERT_KEY: /etc/kong/ssl/mycert.key
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stdout
    depends_on:
      - kong-database
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 10s
      timeout: 10s
      retries: 10
    ports:
      - "8000:8000"
      - "8001:8001"
      - "8443:8443"
      - "8444:8444"
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: "4000M"
    logging:
      driver: "json-file"
      options:
          max-file: "3"
          max-size: "10M"

```

Certificate was added using Admin API and Konga UI, plus inside docker container i put mycert.crt and mycert.key to /etc/kong/ssl/, but nothing helped and there are no errors in logs.

Response from GET Request to [https://example.com:8444/certificates](https://example.com:8444/certificates) (when disable SSL Validation in Insomnia)

```auto
{
    "data": [
        {
            "key_alt": null,
            "created_at": 1650871124,
            "cert_alt": null,
            "key": "-----BEGIN RSA PRIVATE KEY-----\cert-key-example\n-----END RSA PRIVATE KEY-----",
            "id": "7ebdca61-4598-4e17-bdf8-2239c41ce09b",
            "tags": null,
            "snis": [
                "example.com"
            ],
            "cert": "-----BEGIN CERTIFICATE-----\cert-example\n-----END CERTIFICATE-----"
        }
    ],
    "next": null
}

```

Curl example

```auto
curl -i -v https://example.com:8443/api
* Trying ip:8443...
* TCP_NODELAY set
* Connected to example.com (ip) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

```

---

<div class="post-metadata">

**Author:** ![rbessembe](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/rbessembe/32/2802_2.png) [@rbessembe](https://discuss.konghq.com/u/rbessembe)\
**Post date:** [May 4, 2022, 7:35am UTC](https://discuss.konghq.com/t/kong-api-gateway-ssl-tls-certificates/10105/2 "2022-05-04T07:35:27Z")

</div>

It’s not a bug, I figured it out, Kong needs ca-bundle certificate not just crt.