[SSL: CERTIFICATE_VERIFY_FAILED] Error with OIDC_SKIP_SSL_VERIFY=true

[louisfgr]

Hey! I recently came across this project, thought it looked interesting and decided to give it a try.
Setting it up with the developer credentials was straightforward, and after briefly exploring the web front end, I wanted to try out authentication with PocketID.
I quickly spun up a fresh Docker instance of PocketID and configured Wardrobe as a new OIDC client.

I also had to set OIDC_HOST and OIDC_HOST_IP manually as setting LOCAL_DNS did not work for me.
I also set OIDC_SKIP_SSL_VERIFY to true, as I am using self-signed certificates for my environment.

# Option 1: OIDC
OIDC_ISSUER_URL=https://pocketid.lg.internal
OIDC_CLIENT_ID=<redacted>
OIDC_CLIENT_SECRET=<redacted>
OIDC_END_SESSION_URL=https://pocketid.lg.internal/api/oidc/end-session
# Set to true if your OIDC provider uses a self-signed certificate:
OIDC_SKIP_SSL_VERIFY=true

# Option 2: Forward Auth (TinyAuth, Authelia, etc.)
# AUTH_TRUST_PROXY=true

# DNS Configuration
# ============================================================================
# If your OIDC provider or other services use a local DNS hostname that
# Docker containers can't resolve, set this to your local DNS server IP:
LOCAL_DNS=10.10.11.1
OIDC_HOST=pocketid.lg.internal
OIDC_HOST_IP=10.10.11.10

Unfortunately, when I try to log in to Wardrobe, I get the following error message saying that it cannot verify the certificate, even though it should skip the verification.
I have successfully used the self-signed certificates I use for other services as well. In addition, the root CA certificate is installed on all my client devices, so the connection from my browser is encrypted and established without any error messages.

wardrobe_frontend  | (node:1) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.
wardrobe_frontend  | (Use `node --trace-warnings ...` to show where the warning was created)
wardrobe_nginx     | 172.22.0.1 - - [14/Jun/2026:15:01:36 +0000] "POST /api/auth/signin/oidc HTTP/1.0" 200 361 "https://wardrowbe.lg.internal/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" "10.10.5.12"
wardrobe_backend   | Failed to fetch OIDC discovery from https://pocketid.lg.internal: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1016)
wardrobe_backend   | INFO:     172.22.0.2:57066 - "POST /api/v1/auth/sync HTTP/1.1" 401 Unauthorized
wardrobe_frontend  | Failed to sync user to backend: Failed to contact OIDC provider

Am I missing something? Any help or support would be much appreciated.

[Anyesh]

Heya, from your logs, it looks like your selfsigned certificate isn’t trusted in backend... but you said it's working for your other services... so are you sure your cert is configured properly? And added in trust store? Does the OIDC discovery actually work if you curl it from inside the container?