-
Notifications
You must be signed in to change notification settings - Fork 116
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can't add root certificates #343
Comments
The reference indicates docker for windows. Is the team working Docker for Mac and Docker for Windows one and the same? Also How far down the roadmap is this? It is critical functionality in secure workspaces. |
We're all on the same team. A scheme for persistent SSL certs is fairly high up our priority list. Are On Thu, Aug 25, 2016 at 1:03 PM, kitsushadow notifications@github.com
|
We can store the certs as part of the keychain, yes. I believe that is the intuitive "go-to" for Mac users. |
Heard yesterday the beta update is scheduled for Sept 6 @garthk |
+1 here ... Either Keychain or a |
Encountered this issue today on the stable track. Is this feature available in Beta as of today? |
pushed back to next beta release On Sep 13, 2016 4:00 PM, "Kevin Vecchione" notifications@github.com wrote:
|
I also got similar issue on OSX. How to fix it? |
For now the simplest work around is to add the registries as insecure On Wed, Sep 14, 2016 at 2:59 AM, wuyu notifications@github.com wrote:
|
The access to my company's registry is only possible via HTTPS, and only with a Client Certificate. That's also a feature of |
A patch for this is currently undergoing QA testing. Thanks for your patience. |
Docker for Mac uses the host certificates since Beta27, so closing. |
Perhaps before closing it you could provide instructions on how to implement it... |
@samoht the document you've provided says |
@gloomybrain sorry about that, our docs are wrong: CA integration with OSX keychain is only in the Beta channel (and will be in the next stable release next week). |
I am re-opening the issue to keep track of fixing the docs. |
@samoht Thanks a lot! |
Thanks On Oct 14, 2016 10:39 AM, "Denis Novozhilov" notifications@github.com
|
btw, our docs are now hosted on https://github.com/docker/docker.github.io/tree/master/docker-for-mac so you are very welcome to open a PR to fix that error :p |
The docs state Docker for Mac creates a bundle based on Keychain trusted certs and passes that bundle to Moby... can you tell us how often does it do that? It is every time you start Docker for Mac, is it one time, or is it whenever it gets installed or updated? Thanks |
I believe this fix was in the 1.12.3 stable release. |
Unfortunately I'm gonna have to report on this again: original error appears with latest (at the moment) edge version, downgrade to stable fixes problem. Unfortunately I have uninstalled edge, but if you need more information, let me know, I'll reinstall... Does this actually work, reporting here? Does anybody get notified about new comments on a closed issue? |
Confirming this issue:
|
I have the organizational root cert set to I concur with @kitsushadow, Mac users and enterprises usually use mechanisms (MDM, EDM, GPO, etc.) to publish their organizational root certs into the OS's root store and should be the preferred location. Confirming this issue as well: $ curl -I https://docker.<our_domain>/v2/
HTTP/2 200
...
$ docker login docker.<our_domain> -u ccyr
Password:
Error response from daemon: Get https://docker.<our_domain>/v2/: x509: certificate signed by unknown authority
$ docker --version
Docker version 17.09.0-ce, build afdb6d4 |
Closed issues are locked after 30 days of inactivity. If you have found a problem that seems similar to this, please open a new issue. Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows. |
Expected behavior
Actual behavior
docker run -t -i --rm -v /etc:/mnt/etc -w /mnt/etc alpine sh
can be used to update/etc/ssl/certs
as ifupdate-ca-certificates
had been run, but:Similarly, dropping certificates into
/etc/docker/certs.d
under the/mnt
doesn't help.Information
Diagnostic ID: 4168FFD0-2A6A-4390-B7B7-22F705F5FD3F
Docker for Mac: 1.12.0-a (Build 11213)
macOS: Version 10.11.6 (Build 15G31)
[OK] docker-cli
[OK] app
[OK] moby-syslog
[OK] disk
[OK] virtualization
[OK] system
[OK] menubar
[OK] osxfs
[OK] db
[OK] slirp
[OK] moby-console
[OK] logs
[OK] vmnetd
[OK] env
[OK] moby
[OK] driver.amd64-linux
The text was updated successfully, but these errors were encountered: