Cant verify ssl certificate for remote images

[softpottk]

I dont know if this was related with sozu but, Im using nodejs to display images that proxied using sozu, i have generate valid cert using certbot and verify everything is working.
But when i want to render/display images from my proxied domain that uses sozu, i got certficate error, sometimes i got ssl handshake failed when im trying to upload files.

I got this log from my node console

[cause]: Error: unable to verify the first certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1685:34) at TLSSocket.emit (node:events:519:28) at TLSSocket._finishInit (node:_tls_wrap:1085:8) at ssl.onhandshakedone (node:_tls_wrap:871:12) at TLSWrap.callbackTrampoline (node:internal/async_hooks:130:17) { code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' }

I know its not about sozu but its related with the cert required for ssl when using sozu with https. When i try images proxied from nginx + letsencrypt, it is working fine. I dont know what to adjust, or maybe i generate wrong cert?

My config

saved_state = "./state.json"
log_level = "info"
log_target = "stdout"
handle_process_affinity = true
worker_automatic_restart = true
activate_listeners = true

[[listeners]]
protocol = "http"
address = "0.0.0.0:80"

[[listeners]]
protocol = "https"
address = "0.0.0.0:443"

tls_versions = ["TLS_V12", "TLS_V13"]
cipher_list = [
"TLS13_AES_256_GCM_SHA384",
"TLS13_AES_128_GCM_SHA256",
"TLS13_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
]

[clusters]

[clusters.Site]

protocol = "http"
send_proxy = true
https_redirect = true

frontends = [
{ address ="0.0.0.0:80", hostname = "domain.site" },
{ address = "0.0.0.0:443", hostname = "domain.site", certificate = "/etc/letsencrypt/live/domain.site/fullchain.pem", key = "/etc/letsencrypt/live/domain.site/privkey.pem" },
]

backends = [
{ address = "127.0.0.1:2321" }
]

Is it possible to have http2 enabled too?

[Wonshtrum]

I will look into the certificates problem tomorrow, for now, I can only tell you that frontends have a certificate and certificate_chain fields, and it looks like you put the fullchain on certificate. It may not be enough to explain your problem though.

Unfortunately, http2 is not yet supported in the stable release of Sozu, but we are working on it. If you really need http2 (for forwarding grpc for example) you can try the 1.1.0-rc.2, or the latest commit on the development branch.