Certificate validation issues

Oct 13, 2025 by pinkandtrash.com 83 views

Introduction

In this article, we will discuss how to skip TLS verification when using OIDC (OpenID Connect) with Authentik. OIDC is an authentication protocol that allows clients to verify the identity of users against an identity provider. Authentik is a popular identity and access management solution that supports OIDC. However, in some cases, you may need to skip TLS verification to resolve issues related to certificate validation.

What is OIDC and Authentik?

OIDC is an authentication protocol that allows clients to verify the identity of users against an identity provider. It is based on the OAuth 2.0 authorization framework and provides a standardized way for clients to authenticate users. Authentik is a popular identity and access management solution that supports OIDC. It provides a user-friendly interface for managing users, groups, and roles, as well as a robust authentication and authorization system.

Why Skip TLS Verification?

There are several reasons why you may need to skip TLS verification when using OIDC with Authentik. Some of the most common reasons include:

Certificate validation issues: In some cases, the certificate validation process may fail due to issues with the certificate itself or the trust chain. Skipping TLS verification can help resolve these issues.
Self-signed certificates: If you are using self-signed certificates, you may need to skip TLS verification to avoid certificate validation errors.
Development environments: In development environments, you may need to skip TLS verification to simplify the authentication process.

How to Skip TLS Verification with OIDC and Authentik

To skip TLS verification with OIDC and Authentik, you can use the following methods:

Method 1: Using the `--insecure` Flag

You can use the --insecure flag when running the OIDC client to skip TLS verification. This flag tells the client to ignore certificate validation errors and proceed with the authentication process.

oidc-client --insecure --config-url https://authentik.righive.local/application/o/minio/.well-known/openid-configuration

Method 2: Using the `verify` Option

You can also use the verify option when running the OIDC client to skip TLS verification. This option allows you to specify a custom verification function that can be used to validate the certificate.

oidc-client --verify /path/to/custom/verification/function --config-url https://authentik.righive.local/application/o/minio/.well-known/openid-configuration

Method 3: Using Environment Variables

You can also use environment variables to skip TLS verification. You can set the OIDC_INSECURE environment variable to true to enable insecure mode.

export OIDC_INSECURE=true
oidc-client --config-url https://authentik.righive.local/application/o/minio/.well-known/openid-configuration

Example Use Case: Minio with OIDC and Authentik

Here is an example use case that demonstrates how to skip TLS verification with Minio, OIDC, and Authentik:

# Set environment variables
export MINIO_LOG_LEVEL=DEBUG
export MINIO_IDENTITY_OPENID_CONFIG_URL="https://authentik.righive.local/application/o/minio/.well-known/openid-configuration"
export OIDC_INSECURE=true

# Run Minio with OIDC and Authentik
minio server --address 0.0.0.0:9000 --oidc-issuer-url https://authentik.righive.local/application/o/minio/.well-known/openid-configuration

Conclusion

In this article, we discussed how to skip TLS verification when using OIDC with Authentik. We covered three methods for skipping TLS verification, including using the --insecure flag, the verify option, and environment variables. We also provided an example use case that demonstrates how to skip TLS verification with Minio, OIDC, and Authentik. By following these methods, you can resolve issues related to certificate validation and simplify the authentication process.

Additional Resources

How to Configure OIDC with Minio
How to Use Authentik with Minio
Q&A: Skipping TLS Verification with OIDC and Authentik =====================================================

Introduction

In our previous article, we discussed how to skip TLS verification when using OIDC (OpenID Connect) with Authentik. OIDC is an authentication protocol that allows clients to verify the identity of users against an identity provider. Authentik is a popular identity and access management solution that supports OIDC. However, in some cases, you may need to skip TLS verification to resolve issues related to certificate validation.

Q&A Session

Q: What is the purpose of skipping TLS verification?

A: The purpose of skipping TLS verification is to resolve issues related to certificate validation. This can include certificate validation errors, self-signed certificates, and development environments where certificate validation is not necessary.

Q: How do I skip TLS verification with OIDC and Authentik?

A: There are three methods to skip TLS verification with OIDC and Authentik:

Using the --insecure flag: You can use the --insecure flag when running the OIDC client to skip TLS verification.
Using the verify option: You can also use the verify option when running the OIDC client to skip TLS verification.
Using environment variables: You can also use environment variables to skip TLS verification.

Q: What is the `--insecure` flag?

A: The --insecure flag is a command-line option that tells the OIDC client to ignore certificate validation errors and proceed with the authentication process.

Q: What is the `verify` option?

A: The verify option is a command-line option that allows you to specify a custom verification function that can be used to validate the certificate.

Q: How do I set the `OIDC_INSECURE` environment variable?

A: You can set the OIDC_INSECURE environment variable to true to enable insecure mode.

Q: What is the difference between `--insecure` and `OIDC_INSECURE`?

A: The --insecure flag is a command-line option that can be used to skip TLS verification, while the OIDC_INSECURE environment variable is a system-wide setting that can be used to enable insecure mode.

Q: Can I use both `--insecure` and `OIDC_INSECURE` together?

A: Yes, you can use both --insecure and OIDC_INSECURE together to skip TLS verification.

Q: What are the risks of skipping TLS verification?

A: The risks of skipping TLS verification include:

Certificate validation errors: Skipping TLS verification can lead to certificate validation errors, which can compromise the security of your application.
Man-in-the-middle attacks: Skipping TLS verification can make your application vulnerable to man-in-the-middle attacks.
Data breaches: Skipping TLS verification can lead to data breaches, which can compromise sensitive information.

Conclusion

In this Q&A article, we discussed how to skip TLS verification when using OIDC with Authentik. We covered common questions and answers related to skipping TLS verification, including the purpose of skipping TLS verification, how to skip TLS verification, and the risks of skipping TLS verification. By following these guidelines, you can resolve issues related to certificate validation and simplify the authentication process.