Docker构建时因SSL证书问题导致Crate下载失败

问题详情 #

构建Rust容器应用时，Cargo无法下载crates.io的依赖，报错SSL证书验证失败，切换Rust镜像版本（1.71/1.61）问题依旧。

错误日志 #

Updating crates.io index
error: failed to get `chrono` as a dependency of package `timeserver v0.1.0 (/timeserver)`

Caused by:
  failed to query replaced source registry `crates-io`

Caused by:
  download of config.json failed

Caused by:
  failed to download from `https://index.crates.io/config.json`

Caused by:
  [60] SSL peer certificate or SSH remote key was not OK (SSL certificate problem: unable to get local issuer certificate)

应用代码 #

use chrono::prelude::*;
use warp::Filter;

#[tokio::main]
async fn main() {
    // Match any request and return the current date and time
    let routes = warp::any().map(|| {
        let local_date_time: DateTime<Local> = Local::now();
        let response: String = format!("Hello from Rust at {}", local_date_time);
        response
    });

    warp::serve(routes).run(([127, 0, 0, 1], 3030)).await;
}

Cargo.toml配置 #

[package]
name = "timeserver"
version = "0.1.0"
edition = "2021"

[dependencies]
chrono = { version = "0.4.26", features = ["serde"] }
tokio = { version = "1.29.1", features = ["full"] }
warp = "0.3.5"

Dockerfile内容 #

FROM rust:1.71 as build

# Create a new empty shell project
RUN USER=root cargo new --bin timeserver
WORKDIR /timeserver

# Copy over the manifests
COPY ./Cargo.lock ./Cargo.lock
COPY ./Cargo.toml ./Cargo.toml

# This build step will cache the dependencies
RUN cargo build --release
RUN rm src/*.rs

# Copy the source tree
COPY ./src ./src

# Build for release
RUN rm ./target/release/deps/timeserver*
RUN cargo build --release

# The final base
FROM rust:1.71-slim-buster

# Copy the build artifact from the build stage
COPY --from=build /timeserver/target/release/timeserver .

EXPOSE 3030

# Set the startup command to run the binary
CMD ["./timeserver"]

原因分析 #

错误核心是容器内CA证书链不完整或配置异常，导致Cargo无法验证crates.io的SSL证书。可能的触发场景：

1. 网络环境存在代理/防火墙，替换了公共SSL证书，容器内缺少对应的根证书
2. Rust镜像自带的CA证书库过期或不完整

解决办法 #

方法1：安装完整CA证书（推荐） #

修改Dockerfile的构建阶段和最终镜像阶段，安装并更新CA证书：

FROM rust:1.71 as build

# 安装CA证书并更新证书库
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates

# 后续构建步骤不变
RUN USER=root cargo new --bin timeserver
WORKDIR /timeserver
COPY ./Cargo.lock ./Cargo.lock
COPY ./Cargo.toml ./Cargo.toml
RUN cargo build --release
RUN rm src/*.rs
COPY ./src ./src
RUN rm ./target/release/deps/timeserver*
RUN cargo build --release

FROM rust:1.71-slim-buster

# 最终镜像同样安装CA证书（若运行时需网络请求）
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates && rm -rf /var/lib/apt/lists/*

COPY --from=build /timeserver/target/release/timeserver .
EXPOSE 3030
CMD ["./timeserver"]

方法2：临时禁用SSL验证（仅测试用） #

添加环境变量跳过证书验证，生产环境禁止使用：

# 在cargo build命令前添加环境变量
RUN CARGO_HTTP_CHECK_REVOKE=false cargo build --release

方法3：添加自定义根证书（企业/代理网络） #

若网络使用自定义SSL证书，将根证书文件（如my-root-ca.crt）复制到容器并更新证书库：

FROM rust:1.71 as build

# 复制自定义根证书并更新
COPY ./my-root-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates

# 后续构建步骤不变...

内容的提问来源于stack exchange，提问作者russoue