tls: failed to verify certificate: x509 while connecting to Delinea Secret Server

[shrishs]

Describe the bug
While connecting to Delinea Secret Server there is no parameter to specify CA certificate. official document
does not have such kind of parameter mentioned.

To Reproduce
Steps to reproduce the behavior:

1. Create a secret with the following data
   stringData:
   AVP_TYPE: delineasecretserver
   AVP_DELINEA_URL: https://xx-thycotic.abc.local/SecretServer
   AVP_DELINEA_USER: admin
   AVP_DELINEA_PASSWORD: xxxxxxxx
   AVP_DELINEA_DOMAIN: local
   Tried the following combination
   VAULT_CACERT: /etc/pki/tls/certs/ca-bundle.crt
   CACERT: /etc/pki/tls/certs/ca-bundle.crt
   AVP_DELINEA_CACERT: /etc/pki/tls/certs/ca-bundle.crt

2. CA certificate is mounted to /etc/pki/tls/certs/ca-bundle.crt

    # Attention: overriding the ca-bundle.crt from Thycotic CA server            
    - name: custom-tools
      subPath: xx-thycotic.abc.local-root.pem
      mountPath: /etc/pki/tls/certs/ca-bundle.crt
   

3. Create the application. Following logs are displayed in the pod

error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests: sh -c \"helm template $ARGOCD_APP_NAME --include-crds -n $ARGOCD_APP_NAMESPACE ${ARGOCD_ENV_HELM_ARGS} . |\\nargocd-vault-plugin generate --verbose-sensitive-output -\\n\" failed exit status 1: 2024/01/29 17:27:32 reading configuration from environment, overriding any previous settings
[ERROR] grant response error:Post " https://xx-thycotic.abc.local/SecretServer/oauth2/token\": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead\n2024/01/29
[ERROR] error getting accessToken:Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token\": tls: failed to verify certi...

4. Using curl from the command of the pod it works.
   API_USERNAME=admin
   API_PASSWORD=xxxxxxxx
   SECRETID_ACCESS=522
   requestBody="username=$API_USERNAME&password=$API_PASSWORD&grant_type=password"
   PAM_URL=https://xx-thycotic.abc.local/SecretServer
   apiUrl=$PAM_URL/api/v1/secrets/$SECRETID_ACCESS/fields/Password
   pamUrl=$PAM_URL/oauth2/token

curl -s -X POST -H "Accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -d $requestBody $pamUrl
{"access_token":"AgKO8......","token_type":"bearer","expires_in":28800,"refresh_token":"vof...."}

[shrishs]

I also tried running the command directly.But still the same result.There is no way I can pass the CACERT.It is setting the VAULT_CACERT and VAULT_CAPATH .But I believe that is for the Hashicorp Vault not for Delinea

argocd-vault-plugin generate -s thycotic-poc:avp-delinea-backend-secret
argocdvault/example/samplesecret/templates/testsecret.yaml --verbose-sensitive-output

2024/01/31 07:44:36 reading configuration from secret thycotic-poc:avp-delinea-backend-secret
2024/01/31 07:44:36 parsed secret name as avp-delinea-backend-secret from namespace thycotic-poc
2024/01/31 07:44:36 Setting VAULT_CACERT to /etc/pki/tls/certs/ca-bundle.crt for backend SDK
2024/01/31 07:44:36 Setting VAULT_CAPATH to /etc/pki/tls/certs/ca-bundle.crt for backend SDK
2024/01/31 07:44:36 reading configuration from environment, overriding any previous settings
2024/01/31 07:44:36 AVP configured with the following settings:

2024/01/31 07:44:36 avp_delinea_url: https://[xx-thycotic.abc.local/SecretServer]
2024/01/31 07:44:36 avp_delinea_cacert: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 avp_delinea_domain: local
2024/01/31 07:44:36 vault_capath: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 avp_kv_version: 2
2024/01/31 07:44:36 avp_delinea_user: admin
2024/01/31 07:44:36 insecureskipverify: true
2024/01/31 07:44:36 cacert: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 avp_type: delineasecretserver
2024/01/31 07:44:36 delinea_capath: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 delinea_cacert: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 vault_cacert: /etc/pki/tls/certs/ca-bundle.crt
2024/01/31 07:44:36 avp_delinea_password: xxxxxxxx

[ERROR] grant response error:Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead
2024/01/31 07:44:36 [ERROR] error getting accessToken:Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead
Error: could not access secret 522, error: Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead

[shrishs]

Got it working by building a separate image
Use following instruction in Docker file
COPY ./x-thycotic.abc-root.pem /etc/pki/tls/certs/ca-bundle.crt