Trusted certs do not work for custom LLM provider #2727
k2042 opened 2 months ago

Tried to point onedev installation (docker container) to LM Studio service hosting a lite model. The service is behind a nginx proxy with http/2 and self-signed cert configured. It does not trust it obviously, but even if I place or mount the certificate (PEM, seemingly the right format, openssl created with CN and subjectAltName=DNS defined) in the /opt/onedev/conf/trust-certs folder, as per documentation, the error stil remains, when trying to request the models list:

21:58:27 ERROR i.o.s.model.support.AiModelSetting - Error getting models javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Tested with a public webhook utility which supplies a proper cert - it works. So all the services are working and available, just the cert is not loaded as trusted somehow?

  • k2042 commented 2 months ago

    Not a java dev, but the line 103 here seems like it does not configure any store for trusted custom certs:

    https://code.onedev.io/onedev/server/~files/main/server-core/src/main/java/io/onedev/server/model/support/AiModelSetting.java

  • k2042 commented 2 months ago

    Found the exact place to put the certificate into in the current version:

    keytool -import -trustcacerts -alias lmstudio -file /lmstudio.crt -keystore /usr/lib/jvm/java-17-openjdk-amd64/lib/security/cacerts -storepass changeit
    

    In fact, the shortcut works:

    keytool -import -trustcacerts -alias lmstudio -file /lmstudio.crt -cacerts -storepass changeit
    

    In my docker compose I had to chain the command with the entry point. Still would have been nice to have an option of just putting trusted certs into folder without running commands.

  • OneDev commented 2 months ago

    State changed as build OD-7256 (15.0.0) is successful

  • OneDev changed state to 'Closed' 2 months ago
    Previous Value Current Value
    Open
    Closed
1/1
Type
Bug
Priority
Normal
Assignee
Affected Versions
14.1.9
Labels
No labels
Issue Votes (0)
Watchers (3)
Reference
OD-2727
Please wait...
Connection lost or session expired, reload to recover
Page is in error, reload to recover