Skip to content

[enterprise-3.6] Lists what hostnames and IPs are needed for custom certificates followup #8281

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 12, 2018
Merged

[enterprise-3.6] Lists what hostnames and IPs are needed for custom certificates followup #8281

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions install_config/registry/deploy_registry_existing_clusters.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,52 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCyOJ5garOYw0sm
----
====
+
- The secured registry should contain the following Subject Alternative Names (SAN) list:
+
* Two service hostnames.
+
For example:
+
----
docker-registry.default.svc.cluster.local
docker-registry.default.svc
----
+
* Service IP address.
+
For example:
+
----
172.30.124.220
----
+
Use the following command to get the Docker registry service IP address:
+
----
oc get service docker-registry --template='{{.spec.clusterIP}}'
----
+
* Public hostname.
+
For example:
+
----
docker-registry-default.apps.example.com
----
+
Use the following command to get the Docker registry public hostname:
+
----
oc get route docker-registry --template '{{.spec.host}}'
----
+
For example, the server certificate should contain SAN details similar to the following:
+
----
X509v3 Subject Alternative Name:
DNS:docker-registry-public.openshift.com, DNS:docker-registry.default.svc, DNS:docker-registry.default.svc.cluster.local, DNS:172.30.2.98, IP Address:172.30.2.98
----
+
The registry console loads a certificate from the *_/etc/cockpit/ws-certs.d_*
directory. It uses the last file with a *_.cert_* extension in alphabetical
order. Therefore, the *_.cert_* file should contain at least two PEM blocks formatted in the OpenSSL style.
Expand Down