Feature: TLS Expiry Notice

[xealot]

Description

We use TLS to communicate between our docker clients and servers. After a while we begin to take this for granted and forget about it. Sometimes a certificate will expire and then it will take us some time debugging to figure out what's going on.

Steps to reproduce the issue:

1. Have TLS communication between docker client and server
2. Have TLS certificate expire

Describe the results you received:

I received a message from docker where the only technical portion of the error was bad cert.

Describe the results you expected:

I expect that when a certificate is close to expiring, perhaps, 30 days out. That the client (or server) would warn me that there are only N days left before this certificate expires.

[cpuguy83]

I don't know if we should be warning about these certs, but we can certainly do better than bad cert when the cert is expired.

[adeniyistephen]

@xealot @dnephin @thaJeztah Is there a PR for this Issue yet? I would love to work on it. Thanks

[thaJeztah]

I don't think there's a pull request for this. I think the error that's mentioned here is likely to come from the daemon. The only occurrence of bad certxxx I could find in the daemon / API client code (doing a quick search) is this part; https://github.com/moby/moby/blob/46cdcd206c56172b95ba5c77b827a722dab426c5/client/request.go#L131-L133

if cli.scheme == "https" && strings.Contains(err.Error(), "bad certificate") {
	return serverResp, errors.Wrap(err, "The server probably has client authentication (--tlsverify) enabled. Please check your TLS client certification settings")
}

I'm not sure if bad cert is the only error it returned in this example, or if more information was returned about the certificate having expired; this information may come from Go's crypto package; https://github.com/golang/go/blob/93e4e26d5b909c3dbeeb638534461155f06ecf5c/src/crypto/tls/alert.go#L64-L99

[thaJeztah]

closing as this went stale, but pull requests that allow exposing more details about such failures always welcome