TLS failed in Docker

zaman sakib

I have very limited knowledge about TLS certification. I wanted to enable https for docker daemon. I followed this tutorial but at the end failed to start docker daemon.

I am using docker in a Ubuntu 16.04 VM and my client and server is the same machine. So I use the $hostname as the 'Common Name' during all the process.

After following the whole process in docker documentation when I run

sudo dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:2376

I get the INFO log that "API listen on [::]:2376"

When I use the below command:

docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$HOST:2376 version

I get proper response.

But when I reload the daemon and try to start docker it says failed to start docker and give the following message-

Job for docker.service failed because the control process exited with error code.  
See "systemctl status docker.service" and "journalctl -xe" for details.

Output of 'journalctl -xe' is:
enter image description here

I copied the necessary certificate to ~/.docker/ and the 'ExecStart' in my /lib/systemd/system/docker.service file is:

ExecStart=/usr/bin/dockerd -H fd:// -H 0.0.0.0:2376 \
     --tlsverify --tlscacert=/home/sakib/.docker/ca.pem \
     --tlskey=/home/sakib/.docker/key.pem \
     --tlscert=/home/sakib/.docker/cert.pem

When I try to communicate with the API I get the following response:

$ curl -X GET https://0.0.0.0:2376/images/json

curl: (35) gnutls_handshake() failed: Certificate is bad

$ docker version

Client:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:        Thu Aug 18 05:33:38 2016
 OS/Arch:      linux/amd64
An error occurred trying to connect: Get https://EL802:2376/v1.24/version: x509: certificate is valid for $HOST, not EL802 

NOTE: EL802 is my hostname which I set as the 'HOST' environment variable.

I think the problem is with the 'CN' name that I chose while creating client certificate. I create the server and client certificate as below-

Server:

openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr               

Client:

openssl req -subj '/CN=$HOST' -new -key key.pem -out client.csr

As my client and server is my host machine(EL802) which I set as the $HOST variable.

VonC

Your picture does not show the full error line, but if the error message is:

 pid file found, ensure docker is not running or delete /var/run/docker.pid

Try and delete the pid, and restart.
Also double-check your docker installation on Ubuntu, and its systemd configuration.

x509: certificate is valid for $HOST, not EL802

That means the certificate has been created with the string $HOST instead of its actual value.

openssl req -subj '/CN=$HOST'

The strong quoting of the single quotes would prevent the shell to replace $HOST with its value. Use double quotes.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

Docker swarm TLS Failed to validate pending node

From Dev

docker push failed: net/http: TLS handshake timeout

From Dev

Docker TLS error on Mac

From Dev

Docker TLS Error on Ubuntu

From Dev

Docker TLS Error on Ubuntu

From Java

TLS initialization failed on GET Request

From Dev

My sendmail log get TLS setup failed

From Dev

OpenVPN - TLS key negotiation failed on Raspbian

From Dev

Docker: Are you trying to connect to a TLS-enabled daemon without TLS?

From Dev

Docker installation failed

From Dev

Docker service start failed

From Dev

Docker Failed to Start

From Dev

Firefox in Docker, failed in isolation

From Dev

docker-machine without TLS verification

From Dev

Docker private registry | TLS certificate issue

From Dev

Setting TLS options for Docker as Environment Variables

From Dev

Docker private registry | TLS certificate issue

From Dev

docker the docker registry (a private installation of it) use https (tls/ssl)

From Dev

docker the docker registry (a private installation of it) use https (tls/ssl)

From Dev

Mailx SSL/TLS handshake failed: Unknown error -5938

From Dev

Recieved TLS alert from the server: Handshake failed (40)

From Java

docker build failed at 'Downloading mariadb'

From Dev

run docker on overlay network failed

From Dev

docker build failed No repomd file

From Dev

ctime_r failed in docker

From Dev

docker notary : tls: oversized record received with length 20527

From Dev

TLS challenge with docker-compose: acme: error presenting token: timeout

From Dev

DOCKER_TLS_VERIFY, DOCKER_HOST, and DOCKER_CERT_PATH on Ubuntu

From Dev

Keycloak / Docker Mac OS - CI runtime exec failed: exec failed

Related Related

HotTag

Archive