docker unable to navigate to a web site using https - windows

Question

I have the following trivial docker file:
FROM mcr.microsoft.com/windows/servercore:ltsc2019
WORKDIR /azp
COPY test.ps1 .
CMD powershell .\test.ps1
Where test.ps1 is:
C:\test> cat .\test.ps1
curl https://cnn.com -UseBasicParsing
The script can run just fine on my machine, but not in a docker container:
C:\test> docker build -t test:latest .
Sending build context to Docker daemon 75.26kB
Step 1/4 : FROM mcr.microsoft.com/windows/servercore:ltsc2019
---> 782a75e44953
Step 2/4 : WORKDIR /azp
---> Using cache
---> b43270631602
Step 3/4 : COPY test.ps1 .
---> Using cache
---> 10cfc66cff37
Step 4/4 : CMD powershell .\test.ps1
---> Using cache
---> 187be18c5495
Successfully built 187be18c5495
Successfully tagged test:latest
C:\test> docker run test
curl : The underlying connection was closed: Could not establish trust
relationship for the SSL/TLS secure channel.
At C:\azp\test.ps1:1 char:1
+ curl https://cnn.com -UseBasicParsing
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt
pWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
ll.Commands.InvokeWebRequestCommand
Note that replacing https://cnn.com (https) with http://google.com (http) works, so this is clearly something about the https.
What am I missing?
P.S.
I am using Windows 10 with the most recent docker switched to use windows containers.

Answer 1

So I managed to make it work for https://google.com by following these steps:
Navigate to https://google.com and check what is the root certificate. It is a certificate with thumbprint 75E0ABB6138512271C04F85FDDDE38E4B7242EFE
Export the aforementioned certificate as well as the ZScaler root certificate (D72F47D87420E3F0F9BDCAC6F03A566743C481B9) to a special directory that will be included in the image under C:\containers.
Modify the test.ps1 script - see below.
Modify the Dockerfile script - see below.
test.ps1
Get-ChildItem /certificates | ForEach-Object {
$null = Import-Certificate -FilePath $_.FullName -CertStoreLocation Cert:\LocalMachine\Root
}
$res = Invoke-WebRequest https://google.com -UseBasicParsing
$res.StatusDescription
Dockerfile
FROM mcr.microsoft.com/windows/servercore:ltsc2019
COPY certificates certificates
WORKDIR /azp
COPY test.ps1 .
CMD powershell .\test.ps1
So, on the host machine I run the following commands:
C:\test> $certs = dir Cert:\LocalMachine\Root |? { $_.Thumbprint -eq '75E0ABB6138512271C04F85FDDDE38E4B7242EFE' -or $_.Thumbprint -eq 'D72F47D87420E3F0F9BDCAC6F03A566743C481B9' }
C:\test> $certs
PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root
Thumbprint Subject
---------- -------
D72F47D87420E3F0F9BDCAC6F03A566743C481B9 E=support#zscaler.com, CN=Zscaler Root CA, OU=Zscaler Inc., O=Zscaler Inc., L=San Jose, S=California, C=US
75E0ABB6138512271C04F85FDDDE38E4B7242EFE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
C:\test> $certs |% { Export-Certificate -FilePath "c:\test\certificates\$($_.Thumbprint).cer" -Cert $_ }
Directory: C:\test\certificates
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 1/5/2020 8:40 PM 1239 D72F47D87420E3F0F9BDCAC6F03A566743C481B9.cer
-a---- 1/5/2020 8:40 PM 958 75E0ABB6138512271C04F85FDDDE38E4B7242EFE.cer
C:\test> docker run test
OK
C:\test>

Answer 2

It looks like your container is not able to verify TLS server certificate. Probably CA certificates (maybe they have different technical term in the Windows) are missing in the container.
You can:
-SkipCertificateCheck (available from PowerShell V6.0+), so TLS cert verification will be skipped - good choice for development, but it will sacrifice security partially
"mount Windows hosts certificate store in container" - Docker forum