Documentation: How to add a self-signed certificate

[kennu]

I'm trying to use a private Docker image registry with a self-signed certificate. But I can't find documentation how to add the self-signed certificate to boot2docker, so that the Docker client would accept it.

[SvenDowideit]

oh wow. I've not gone there myself, so it needs someone to spend some time nutting out the details :/

[steeve]

I think you might need to rebuild the image with your certificate in it.

[kennu]

I can see a bunch of preinstalled certificates in /usr/local/etc/ssl/certs/, but I just can't figure out how to add my own. I think in Ubuntu/Debian, one would copy it there and run "update-ca-certificates". Perhaps that command could be added to boot2docker?

[steeve]

The certificates are installed when unpacking the openssl.tcz TCL package.

In any case, you'll need to execute these on your own Dockerfile, the ISO rootfs is in $ROOTFS:

FROM boot2docker/boot2docker

RUN <whatever>
ADD mycertif $ROOTFS/....

RUN /make_iso.sh
CMD ["cat", "boot2docker.iso"]

[SvenDowideit]

OR, you can use your persistence partition and add the data and scripts to /var/lib/boot2docker and call the script from a /var/lib/boot2docker/bootlocal.sh which you create.

[kfish]

To add mycert.pem (exported from your keychain on osx-host) to a running boot2docker, copy it over, symlink it and symlink its hash:

osx-host$ boot2docker ssh
# Picture of a whale
docker@boot2docker:~$ scp username@osx-host:Documents/mycert.pem /tmp
docker@boot2docker:~$ sudo -s
root@boot2docker:~$ mv /tmp/mycert.pem /usr/local/share/ca-certificates
root@boot2docker:~$ cd /etc/ssl/certs
root@boot2docker:/etc/ssl/certs$ ln -s /usr/local/share/ca-certificates/mycert.pem .
root@boot2docker:/etc/ssl/certs$ openssl x509 -hash -in mycert.pem
# This will output an 8 hex digit hash hhhhhhhh
docker@boot2docker:/etc/ssl/certs$ ln -s mycert.pem hhhhhhhh.0

I found this out by examining the c_rehash script, which update-ca-certificates would run if it and perl existed on boot2docker.

[SvenDowideit]

moby/moby#6890

I hope to be adding code to the boot2docker iso to generate the cert, and then export it to host system.

[btrepp]

@kfish I also had to append the cert to /etc/ssl/certs/ca-certificates.crt

Though boot2docker uses tce, so I'm not sure if this will disappear if the machine is rebooted?.

I'm using docker as a provider in vagrant.

[magnusart]

Have the documentation been resolved yet?

I tried the instructions above in the boo2docker VM. But I only get an empty error when trying to do docker login:

2014/10/25 22:52:50 Error response from daemon:

boot2docker version information

Boot2Docker-cli version: v1.3.0
Git commit: deafc19

[virtuald]

It would be good to make this process significantly easier than it currently is, since as of 1.3.1 docker no longer allows connections to non-SSL registries. We need an easy way to deposit the certificate in a place that will persist, otherwise we will need to copy the cert each time we boot2docker up.

[SvenDowideit]

@virtuald the boot2docker cli tool does all this for you automatically when you run boot2docker up

the certificates are auto-generated during vm bootup, and then are copied to the right place - and $(boot2docker shellinit) will set the 3 environment variables you need for the Docker client to just work.

and so I'm going to close this PR - i think its adding confusioin about manual steps you don't do anymore

[btrepp]

How does boot2docker know what certificates to use?. I thought this was about specifying custom certificates?.

Is there a folder/place we need to put them to have boot2docker cli's grab them and place them in the vm?

[virtuald]

@SvenDowideit No, please open this ticket again. The certificates that boot2docker generates as of 1.3.x for the user is for connecting to the docker daemon, not a private docker registry with custom certificates.

[tianon]

Indeed, this issue is about the other certificates. 👍

[virtuald]

I realize this issue is about 'documentation', but the current process of adding a registry cert is annoying at best. I would recommend adding yet another boot2docker command (maybe addregistrycert) that copies the certificate to the right place on the permanent storage, and at boot time the iso copies all the certs to /etc/docker/certs.d/. For example, I'm using the following script in bootlocal.sh:

#!/bin/sh
sudo cp -r /var/lib/boot2docker/etc/docker /etc

[SvenDowideit]

@virtuald nice suggestion - wanna make a PR? :)

(and ug - sorry, i was trying to doo to much at once obviously)

[virtuald]

My go-fu is a bit weaker than I would like, and I have about 3 other projects that I'm behind on. However, should be easy enough for someone familiar with the codebase to do. ;)

[metcalfc]

I see at least 3 approaches in this issue. I'm happy to do the work but which of them is the best practice?

1. append the cert to /etc/ssl/certs/ca-certificates.crt
2. do the hash magic that update-ca-certificates would do
3. copies all the certs to /etc/docker/certs.d/

[virtuald]

I like option 3.

[thaJeztah]

+1 on option 3

[aseppala]

+1 on option 3

[pohl]

I'm having an issue that may be related, but I'm not sure: I work for an organization that has a certificate-rewriting proxy and it is getting in the way with my attempts to even use the public registry at Docker Hub. I am just learning Docker, so I'm curious whether the steps outlined in this PR discussion would also apply to my situation.

http://stackoverflow.com/questions/27536180/docker-on-mac-behind-proxy-that-changes-ssl-certificate

[SvenDowideit]

+1 on option 3 :)

@pohl oh gads, basically, you're in an organisation that's attacking you. I would probably make a docker container that runs some kind of vpn like proxy (i'm thinking ssh) to talk to my own host out there on the internet. and then have the Docker daemon talk to that proxy container. (using --insecure-registry

[btrepp]

I'm in the same situation, it basically involved manually putting the certificates in boot2dockers VM, not exactly elegant.

Runninga VPN/ssh is most likely difficult in corporate land too, machines can only get to the internet through the proxies (that MITM ssl). So you can't exactly punch out via port 22 :S

[SvenDowideit]

/me is evil and runs an ssh daemon on port 80.

[btrepp]

Even still, it has to go through a corporate proxy. So you are either muxing ssh over http (this sounds horrible!), or you have a special ssh server that works with CONNECT https calls.

That technique may also draw the ire of the enterprisey security guys that are trying to MITM you anyway. My usually approach is make my apps use the corporate certs, If they want to inspect a whole bunch of binary data they are free to do it :)

I imagine there is a way to get bootlocal to install the certs, but atm I'm personally having 0 success with having bootlocal.sh even run.

[SvenDowideit]

oh? ok, then we need to work that out. The only persistent place on your b2d, is /var/lib/boot2docker - a script called /var/lib/boot2docker/bootlocal.sh (and it can't be a bash script) will run at startup - though after the docker daemon has started, so you'll probably need to restart that...

[olimsaidov]

@varsy, Thank you!

[Shuliyey]

as far as I know boot2docker doesn't come with any certificate import tools, so this made it a bit difficult to add ssl certificate to your certificate bundle.

But you can still do it manually.

• make sure you have your selfsigned certificate in PEM format, usually this file has the .crt file type, copy the file to /usr/local/share/ca-certificates

sudo cp <your_crt_file> /usr/local/share/ca-certificates/

• check again this crt file of your is in PEM format, the below command should return 1, if it is in PEM format, otherwise you should convert your crt file to PEM format.

cat /usr/local/share/ca-certificates/<your_crt_file> | grep 'BEGIN.* CERTIFICATE' | wc -l

• (optional) you should verify that the fingerprint of this certificate does match the original certificate you created, but this step is not necessary as long as you are sure the crt file you are trying to import to the ca-bundle can be trusted

openssl x509 -noout -fingerprint -in /usr/local/share/ca-certificates/<your_crt_file>

• create a .pem simlink in /etc/ssl/certs pointing to your original certificate location

sudo ln -s /usr/local/share/ca-certificates/<your_crt_file> /etc/ssl/certs/<your_crt_file_name_without_the_file_type>.pem

• create a hash simlink (this hash simlink should end with .0 extension) in /etc/ssl/certs pointing to the previous .pem simlink you just created

cd /etc/ssl/certs && sudo ln -s <the_previous_pem_simlink_you_created> `openssl x509 -noout -hash -in /usr/local/share/ca-certificates/<your_crt_file>`.0

• last step for extra assurance, append the content of your crt file to the /etc/ssl/certs/ca-certificates.crt. Please do this step carefully, it's always a good idea to back up the /etc/ssl/certs/ca-certificates.crt file, before doing this step (in case you actually overridden the file, instead of modifying it)

sudo -i -u root
cat /usr/local/share/ca-certificates/<your_crt_file> >> /etc/ssl/certs/ca-certificates.crt
exit

If you have done all the above step correctly you should get something like this (remember when you do the grep, grep for your crt file name without the file type. In my case I just grep "blue" short for "bluecoat")

infinityadmin@mep-openstack1:/etc/ssl/certs$ ls -l /etc/ssl/certs | grep blue
lrwxrwxrwx 1 root root     12 Feb  5 07:56 37b52fd1.0 -> bluecoat.pem
lrwxrwxrwx 1 root root     45 Feb  5 07:56 bluecoat.pem -> /usr/local/share/ca-certificates/bluecoat.crt

In my case
the bluecoat.crt is my crt_file, bluecoat.pem is the pem simlink file i created pointing to my bluecoat.crt. 37b52fd1.0 is the hash simlink (ending with .0 extension) I created pointing to my pem simlink.

For more information, you can read this article
http://gagravarr.org/writing/openssl-certs/others.shtml

The final thing to do to have more assurance is to restart docker daemon

sudo /etc/init.d/docker restart

But again, I would still like to address that it would be great if boot2docker can come with a certificate bundle update tool like update-ca-certificates in Ubuntu or update-ca-trust in CentOS

[tobilarscheid]

Hi,

thanks for your input. This really helped a lot! Actually, this is the only working way for boot2docker.

Two additions:

Shouldn't this

ln -s /usr/local/share/ca-certificate.<your_crt_file> /etc/ssl/certs/<your_crt_file_name_without_the_file_type>.pem

rather be

ln -s /usr/local/share/ca-certificates/<your_crt_file> /etc/ssl/certs/<your_crt_file_name_without_the_file_type>.pem

??

Also, in this statement:

cat /usr/local/share/ca-certificates/<your_crt_file> >> /etc/ssl/certs/ca-certificate.crt

the last part should be

cat /usr/local/share/ca-certificates/<your_crt_file> >> /etc/ssl/certs/ca-certificates.crt

[Shuliyey]

thanks @tobilarscheid, you are right 😄

I've fixed the typo ;). Cheers 👍

[daagar]

Holy cow, that works @Shuliyey! I do still need a copy of the *.pem files to be in /var/lib/boot2docker/certs as well but otherwise that was the magic voodoo to finally hit the official docker hub from inside a MITM certificate rewrite proxy.

[Shuliyey]

thank you @daagar , glad it worked 😄 .

sorry I'm actually trying to understand the /var/lib/boot2docker/certs part, do you mean if the certificate is not in /var/lib/boot2docker/certs, you actually still won't be able to do docker pull/push (even with certificates updated in /etc/ssl/certs/)?

Interesting case, does it apply for the both the case?

• doing a docker pull/push from a host terminal (so not in the boot2docker vm, but on the Windows/Mac host)
• doing a docker pull/push inside the boot2docker vm

I believe the /var/lib/boot2docker repository is mainly used to provide the communication between the boot2docker guest vm and the host OS (Windows/Mac). So I'm trying to get a better understanding on how boot2docker manages its certificates verification

you can do

docker-machine ssh default

to get into the boot2docker os vm 😄

[Shuliyey]

thanks @Mickep76 +1 👍

the changes that's made to boot2docker / partition drive will be overwritten everytime docker-machine is restarted. So the /var/lib/boot2docker/bootlocal.sh is useful in this case to keep your changes.

• create the /var/lib/boot2docker/bootlocal.sh file and set the execution permission correctly

sudo touch /var/lib/boot2docker/bootlocal.sh && sudo chmod +x /var/lib/boot2docker/bootlocal.sh

• put your self-signed crt file at /var/lib/boot2docker/certs/, this path can actually be any path, that can keep its files saved (instead of overwritten on docker-machine restart ). E.g. /home/docker/ can also be a good choice

sudo mkdir /var/lib/boot2docker/certs
mv <your_crt_file> /var/lib/boot2docker/certs/

• add the changes to be made into /var/lib/boot2docker/bootlocal.sh, (In this case, we're adding the certificate to /etc/docker/certs.d/<docker_registry_url>)

mkdir -p /etc/docker/certs.d/<your_docker_registry_url> && cp <your_crt_file_location> /etc/docker/certs.d/<your_docker_registry_url>/

• restart docker-machine

# If terminal is actually the docker-machine VM terminal
sudo reboot
# if terminal is started using docker quick start terminal
docker-machine restart <machine_name>

Note: In my case this is my contents in /var/lib/boot2docker/bootlocal.sh

mkdir -p /etc/docker/certs.d/registry.mev-rancher.dev.tech.local && cp /var/lib/boot2docker/certs/radiance.crt /etc/docker/certs.d/registry.mev-rancher.dev.tech.local/

[kumlali]

Thanks @Shuliyey. In my environment(Docker Toolbox 1.9.1i & Windows 7), copying certificate files to /var/lib/boot2docker/certs is enough. I do not need to create /etc/docker/certs.d/<your_docker_registry_url> and copy files to it.

@ALL
After I spent significant time to make Docker Toolbox on Windows behind proxy to work, I decided to create a small project to help others: https://github.com/kumlali/windocker.

Hope you'll find it usefull.

[Shuliyey]

@kumlali nice, would be great also to integrate this into kitematic. If we can configure the proxy and ssl settings inside the kinematic gui (like in the settings page), would make proxy and certificate configuration much easier.

[so0k]

ok, so since Boot2Docker 1.6 any certs you place in /var/lib/boot2docker/certs are automatically loaded for you - cool

see: https://github.com/boot2docker/boot2docker/pull/807/files

[nicklozon]

@Shuliyey thanks for this. My company performs a man in the middle attack, so I had to export the cert from windows certificate manager, copy it into my vm and use openssl to convert it from DER to PEM format with a .crt extension, then followed your instructions.

[gotgenes]

ok, so since Boot2Docker 1.6 any certs you place in /var/lib/boot2docker/certs are automatically loaded for you - cool

see: https://github.com/boot2docker/boot2docker/pull/807/files

If you're arriving here from Google, the above is the proper solution to, "How do I use self-signed certificates when using boot2docker?"

Note, though, at the moment, only certificates that end with .pem will be processed. (I have submitted PR #1167 that would also process certificates ending in .crt per the Docker self-signed certificate instructions.) If you place your certificate in /var/lib/boot2docker/certs/ but it doesn't work, make sure it's in PEM format, and make sure the file name ends with ".pem".

[magnayn]

I've followed the self-signed cert instructions, used the certificate in an nginx proxy, added the cert in /var/lib/boot2docker/certs (actually in my boot2docker 1.11.2, that directory did not exist) and I still get

x509: certificate signed by unknown authority

[gotgenes]

@magnayn Did you reboot your boot2docker instance after adding your certificates to /var/lib/boot2docker/certs? boot2docker will not process the certificates until a reboot takes place. In my case, I issued

docker-machine reboot <boot2docker_instance>

Also, yes, by default there is no certs directory in /var/lib/boot2docker; I had to create it, too.

[magnayn]

Good to know that the need to create the certs directory is normal.

Yes, I rebooted the docker-machine. curl is perfectly happy if I tell it
about the cert on the commandline.

On Thu, Jun 16, 2016 at 4:54 PM, Chris Lasher notifications@github.com
wrote:

@magnayn https://github.com/magnayn Did you reboot your boot2docker
instance after adding your certificates to /var/lib/boot2docker/certs?
boot2docker will not process the certificates until a reboot takes place.
In my case, I issued

docker-machine reboot <boot2docker_instance>

Also, yes, by default there is no certs directory in /var/lib/boot2docker;
I had to create it, too.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#347 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AADRlVDJ37q4NinzftBo5FLr6GOpckp7ks5qMXG9gaJpZM4B5f7W
.

[so0k]

Could you try these instructions? http://docker-saigon.github.io/post/Private-Registry-Setup/ it includes adding trust for self signed CA

[Shuliyey]

@magnayn interesting the boot2docker 1.11 version of docker should work if the certificate is placed in the /var/lib/boot2docker/certs
did you put the public certificate (which is not the private key) in the /var/lib/boot2docker/certs

if you could do the below and verify your certificate (which you put under /var/lib/boot2docker/certs)

cat /var/lib/boot2docker/certs/<your_crt_file> | grep 'BEGIN.* CERTIFICATE' | wc -l # this should return 1

😄

[softwarevamp]

container host does trust the certificate but the not the container itself
when i run ruby got below:

Fetching source index from https://rubygems.org/

Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rubygems.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

the container SHOULD trust it also.

[so0k]

@softwarevamp - for containers to trust ca's from the host, mount the host certs dir and run update-certificates before starting the process in the container?

[MetinSolmaz]

In Boot2Docker (version 17.10.0-ce), for me it only worked when the certificate was called 'ca.crt' in a folder with hostname for which the certificate was used.

So copy the certificate as follows:
/var/lib/boot2docker/etc/docker/certs.d//ca.crt

[leonardochaia]

In Boot2Docker 18.05.0-ce using self-signed certificates it seems to be enough by copying the ca.crt and cert.pem to /etc/docker/certs.d/{hostname} in a bootsync.sh script.

Boot2Docker version 18.05.0-ce, build HEAD : b5d6989 - Thu May 10 16:35:28 UTC 2018 Docker version 18.05.0-ce, build f150324