Certificates do not work in Docker Nginx official image - docker

Question

I have an official Nginx image in which I added certificates and the .conf file so it listens over port 443 and 80. I just added on Nginx official dockerfile:
ADD gp-search2.conf /etc/nginx/conf.d/
ADD STAR.GREY.COM.crt /etc/ssl/certs/
ADD wildcard_grey.com.key /etc/ssl/certs/
I´m using Azure container instaces and I´m creating the container with this command successfully
az container create --resource-group RG --name nginx --image xxxxx.azurecr.io/api-s:nginx4 --cpu 1 --memory 1.5 --registry-username xxxxxx --registry-password xxxxxxxxxx --ip-address public --ports 443 --dns-name-label prod3
After this I get a container created on azure successfully with a public IP and with the FQDN that I provided prod3eastus.azurecontainer.io. Also I create in Dynect.net a new node for the domain we have: newcontainer.example.com and added there the public IP of the new container so that the valid certificates I have on container are ok with than domain.
If I access the container with the public FQDN or the IP that Azure provides I can access ok, but if I try to access with HTTPS I get:
This page isn’t working If the problem continues, contact the site owner. HTTP ERROR 400
and
*WARNING: cannot verify newcontainer.example.com's certificate, issued by ‘CN=Network Solutions OV Server CA 2,O=Network Solutions L.L.C.,L=Herndon,ST=VA,C=US’: Unable to locally verify the issuer's authority.*
Even though that:
the certificates are valid
the certificates are on the same path that I indicate on file.conf in Nginx container (if not container won´t be up).
This is the .conf file I have:
upstream searchapl {
server 40.x.x.x:8080 fail_timeout=0;
}
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name _;
#status_zone go-backend-servers;
ssl_certificate /etc/ssl/certs/STAR.client.COM.pem;
ssl_certificate_key /etc/ssl/certs/STAR.client.COM.key;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://searchapl;
proxy_redirect http:// https://;
# Socket.IO Support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# time out settings
proxy_connect_timeout 159s;
proxy_send_timeout 600;
proxy_read_timeout 600;
proxy_buffer_size 64k;
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_pass_header Set-Cookie;
}
}
This Nginx is used as a reverse proxy that redirects to a Tomcat container that is working ok. Redirection works successfully if I enter container IP. It takes me to Tomcat. But over 443 I get certificates issue. What else can I check? Certificate and key have Read Access.
OK Now I move forward a little step but still getting error. I created the .pem file instead of .crt whit all the chain of primary certificates and intermediate + root.
Don´t get anymore error of unable to check certificate authority but now I´m getting:
***--2018-08-24 21:05:05-- https://xxxxxxxxxxxx.com/
Resolving xxxxxxxxxxxx.com (gp_searchv2.grey.com)... 23.x.x.x
Connecting to xxxxxxxxx.com (xxxxxxxxxx.com)|23.x.x.x|:443... connected.
HTTP request sent, awaiting response... 400
2018-08-24 21:05:05 ERROR 400: (no description).***