Skip to content

docs: add system CA cert workaround for Azure Blob/S3 on older Doris … #3936

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ixzc wants to merge 4 commits into
base: master
Choose a base branch
from
Open

docs: add system CA cert workaround for Azure Blob/S3 on older Doris … #3936

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e22fa19
docs: add system CA cert workaround for Azure Blob/S3 on older Doris …
ixzc Jun 15, 2026
26a208a
Merge branch 'master' into docs/add-ca-cert-workaround-for-older-vers…
ixzc Jun 16, 2026
37cd411
Merge branch 'master' into docs/add-ca-cert-workaround-for-older-vers…
ixzc Jun 17, 2026
53a6460
Merge branch 'master' into docs/add-ca-cert-workaround-for-older-vers…
ixzc Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions docs/lakehouse/storages/azure-blob.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@ By default, if `ca_cert_file_paths` is not configured, Doris uses the operating
- Your environment uses a self-signed certificate, a private CA, or a corporate proxy or gateway that re-signs TLS traffic.
- You encounter errors such as `Problem with the SSL CA cert` or `curl 77: Problem with the SSL CA cert (path? access rights?)` when accessing Azure Blob Storage.

> **For versions without `ca_cert_file_paths`:** The `ca_cert_file_paths` parameter is available starting from Doris 3.1.5 and 4.0.5. If you are using an older version and encounter SSL CA certificate errors, you must ensure the system CA certificates are properly installed and the CA bundle exists at `/etc/ssl/certs/ca-certificates.crt`:
>
> - **RHEL / CentOS / RockyLinux:**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu:** `apt-get install -y ca-certificates`
>
> Then restart all BE nodes. For more details on certificate issues, see [Lakehouse FAQ - Certificate Issues](../../faq/lakehouse-faq.md#certificate-issues).

Example:

```properties
Expand Down
12 changes: 12 additions & 0 deletions docs/lakehouse/storages/s3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,18 @@ By default, if `ca_cert_file_paths` is not configured, Doris uses the operating
- Your environment uses a self-signed certificate, a private CA, or a corporate proxy or gateway that re-signs TLS traffic.
- You encounter errors such as `Problem with the SSL CA cert` or `curl 77: Problem with the SSL CA cert (path? access rights?)` when accessing S3.

> **For versions without `ca_cert_file_paths`:** The `ca_cert_file_paths` parameter is available starting from Doris 2.1. If you are using Doris 2.0.x or earlier and encounter SSL CA certificate errors, you must ensure the system CA certificates are properly installed and the CA bundle exists at `/etc/ssl/certs/ca-certificates.crt`:
>
> - **RHEL / CentOS / RockyLinux:**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu:** `apt-get install -y ca-certificates`
>
> Then restart all BE nodes. For more details on certificate issues, see [Lakehouse FAQ - Certificate Issues](../../faq/lakehouse-faq.md#certificate-issues).

Example:

```properties
Expand Down
12 changes: 12 additions & 0 deletions i18n/zh-CN/docusaurus-plugin-content-docs/current/lakehouse/storages/azure-blob.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@
- 环境中使用了自签名证书、私有 CA，或者会重签 TLS 流量的企业代理或网关。
- 访问 Azure Blob Storage 时出现 `Problem with the SSL CA cert` 或 `curl 77: Problem with the SSL CA cert (path? access rights?)` 等错误。

> **对于不支持 `ca_cert_file_paths` 的版本：** `ca_cert_file_paths` 参数自 Doris 3.1.5 和 4.0.5 起可用。如果你使用的是更早的版本并遇到 SSL CA 证书错误，需要确保系统 CA 证书已正确安装，并且 CA 证书包位于 `/etc/ssl/certs/ca-certificates.crt`：
>
> - **RHEL / CentOS / RockyLinux：**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu：** `apt-get install -y ca-certificates`
>
> 然后重启所有 BE 节点。更多证书相关问题，请参阅 [数据湖 FAQ - 证书问题](../../faq/lakehouse-faq.md#证书问题)。

示例：

```properties
Expand Down
12 changes: 12 additions & 0 deletions i18n/zh-CN/docusaurus-plugin-content-docs/current/lakehouse/storages/s3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,18 @@
- 环境中使用了自签名证书、私有 CA，或者会重签 TLS 流量的企业代理或网关。
- 访问 S3 时出现 `Problem with the SSL CA cert` 或 `curl 77: Problem with the SSL CA cert (path? access rights?)` 等错误。

> **对于不支持 `ca_cert_file_paths` 的版本：** `ca_cert_file_paths` 参数自 Doris 2.1 起可用。如果你使用的是 Doris 2.0.x 或更早版本并遇到 SSL CA 证书错误，需要确保系统 CA 证书已正确安装，并且 CA 证书包位于 `/etc/ssl/certs/ca-certificates.crt`：
>
> - **RHEL / CentOS / RockyLinux：**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu：** `apt-get install -y ca-certificates`
>
> 然后重启所有 BE 节点。更多证书相关问题，请参阅 [数据湖 FAQ - 证书问题](../../faq/lakehouse-faq.md#证书问题)。

示例：

```properties
Expand Down
12 changes: 12 additions & 0 deletions ...-CN/docusaurus-plugin-content-docs/version-4.x/lakehouse/storages/azure-blob.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@
- 环境中使用了自签名证书、私有 CA，或者会重签 TLS 流量的企业代理或网关。
- 访问 Azure Blob Storage 时出现 `Problem with the SSL CA cert` 或 `curl 77: Problem with the SSL CA cert (path? access rights?)` 等错误。

> **对于不支持 `ca_cert_file_paths` 的版本：** `ca_cert_file_paths` 参数自 Doris 3.1.5 和 4.0.5 起可用。如果你使用的是更早的版本并遇到 SSL CA 证书错误，需要确保系统 CA 证书已正确安装，并且 CA 证书包位于 `/etc/ssl/certs/ca-certificates.crt`：
>
> - **RHEL / CentOS / RockyLinux：**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu：** `apt-get install -y ca-certificates`
>
> 然后重启所有 BE 节点。更多证书相关问题，请参阅 [数据湖 FAQ - 证书问题](../../faq/lakehouse-faq.md#证书问题)。

示例：

```properties
Expand Down
12 changes: 12 additions & 0 deletions i18n/zh-CN/docusaurus-plugin-content-docs/version-4.x/lakehouse/storages/s3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,18 @@
- 环境中使用了自签名证书、私有 CA，或者会重签 TLS 流量的企业代理或网关。
- 访问 S3 时出现 `Problem with the SSL CA cert` 或 `curl 77: Problem with the SSL CA cert (path? access rights?)` 等错误。

> **对于不支持 `ca_cert_file_paths` 的版本：** `ca_cert_file_paths` 参数自 Doris 2.1 起可用。如果你使用的是 Doris 2.0.x 或更早版本并遇到 SSL CA 证书错误，需要确保系统 CA 证书已正确安装，并且 CA 证书包位于 `/etc/ssl/certs/ca-certificates.crt`：
>
> - **RHEL / CentOS / RockyLinux：**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu：** `apt-get install -y ca-certificates`
>
> 然后重启所有 BE 节点。更多证书相关问题，请参阅 [数据湖 FAQ - 证书问题](../../faq/lakehouse-faq.md#证书问题)。

示例：

```properties
Expand Down
12 changes: 12 additions & 0 deletions versioned_docs/version-4.x/lakehouse/storages/azure-blob.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@ By default, if `ca_cert_file_paths` is not configured, Doris uses the operating
- Your environment uses a self-signed certificate, a private CA, or a corporate proxy or gateway that re-signs TLS traffic.
- You encounter errors such as `Problem with the SSL CA cert` or `curl 77: Problem with the SSL CA cert (path? access rights?)` when accessing Azure Blob Storage.

> **For versions without `ca_cert_file_paths`:** The `ca_cert_file_paths` parameter is available starting from Doris 3.1.5 and 4.0.5. If you are using an older version and encounter SSL CA certificate errors, you must ensure the system CA certificates are properly installed and the CA bundle exists at `/etc/ssl/certs/ca-certificates.crt`:
>
> - **RHEL / CentOS / RockyLinux:**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu:** `apt-get install -y ca-certificates`
>
> Then restart all BE nodes. For more details on certificate issues, see [Lakehouse FAQ - Certificate Issues](../../faq/lakehouse-faq.md#certificate-issues).

Example:

```properties
Expand Down
12 changes: 12 additions & 0 deletions versioned_docs/version-4.x/lakehouse/storages/s3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,18 @@ By default, if `ca_cert_file_paths` is not configured, Doris uses the operating
- Your environment uses a self-signed certificate, a private CA, or a corporate proxy or gateway that re-signs TLS traffic.
- You encounter errors such as `Problem with the SSL CA cert` or `curl 77: Problem with the SSL CA cert (path? access rights?)` when accessing S3.

> **For versions without `ca_cert_file_paths`:** The `ca_cert_file_paths` parameter is available starting from Doris 2.1. If you are using Doris 2.0.x or earlier and encounter SSL CA certificate errors, you must ensure the system CA certificates are properly installed and the CA bundle exists at `/etc/ssl/certs/ca-certificates.crt`:
>
> - **RHEL / CentOS / RockyLinux:**
> ```bash
> yum install -y ca-certificates
> update-ca-trust
> ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt
> ```
> - **Debian / Ubuntu:** `apt-get install -y ca-certificates`
>
> Then restart all BE nodes. For more details on certificate issues, see [Lakehouse FAQ - Certificate Issues](../../faq/lakehouse-faq.md#certificate-issues).

Example:

```properties
Expand Down