I have a private registry installed on a remote server which can be accessed over TLS.
I have a client certificates that can connect to the registry remotely successfully.
I verified the client certificate using curl command as follows
Curl returned 200 OK with {"repositories":[]} so I am sure the certificates are correct.
Steps: install certificates at ~/.docker/certs.d/10.25.235.23532010 :
followed documentation at https://docs.docker.com/docker-for-windows/faqs/#how-do-i-add-client-certificates and copied my certificates to C:\Users\Administrator\.docker\certs.d\10.25.235.23532010 as ca.crt, client.cert, and client.key
Please note I removed the colon “:” as I windows does not accept it. I got hint to remove colon from github forums and moby code on github.
restart docker
push image docker push 10.25.235.235:32010/nginx:latest
I got error tls: certificate signed by unknown authority
Install ca.crt:
I clicked on ca.crt and installed certificate to “trusted authorities” in my windows
restart docker
push image docker push 10.25.235.235:32010/nginx:latest
I got error tls: bad certificate
copy certificates to “C:\ProgramData\docker\certs.d\10.25.235.23532010”:
Followed the same steps to restart docker and push image, I am getting the same tls errors.
Please advise what should be done to push images to private registry from a windows docker desktop.
Docker version
Client: Docker Engine - Community
Version: 18.09.2
API version: 1.39
Go version: go1.10.8
Git commit: 6247962
Built: Sun Feb 10 04:12:31 2019
OS/Arch: windows/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 18.09.2
API version: 1.39 (minimum version 1.12)
Go version: go1.10.6
Git commit: 6247962
Built: Sun Feb 10 04:13:06 2019
OS/Arch: linux/amd64
Experimental: false
What solved it for me was to not use the certs.d catalog but instead I passed the certificates to my registry using environment variables. (I believe I even had to remove the certs.d folder itself…)
make sure that the certificates you’ve got have been issued to your domain name and not “domain”. Install the root cert on the “client” machines.
P.s. I was never able to push and pull to the registry from the server it ran on, but I got it working from other machines which had installed the CA root cert.
Thanks for your suggestion.
I was able to run the registry on my cluster (kuberentes) using the TLS certificates which requires 2 way SSL from the docker client in order to get images pull/push from the client.
My use case requires to pull/push images from windows based docker client to the remote registry using SSL certs. I am able to curl my remote repository using TLS certs so I know my certificates are correct.
Its just my docker daemon running on the windows OS is not picking up those client certs which are required to pull/push images to a secure registry. Btw, I tried the similar process for linux and macos and I was able to pull/push images.
I’m also using the windows based docker client (docker desktop + WSL docker client) and I can confirm that I’ve got it working using that setup (I’m not using kubernetes however). All I needed to do was to install my root cert in windows and WSL picked it up. Of course I also had to forward the docker client to work with docker desktop:
I have also installed the client certificate in the windows trust store. Git is actually running correctly with this client certificate. It seems as if docker ist not picking the certificate to use it during connection.
When I try to pull an image from the registry I get this error:
Pulling xyz-controller (extern.abc.com/org-docker/car-services/car-configuration:current)... ERROR: error parsing HTTP 400 response body: invalid character '<' looking for beginning of value: "<html>\r\n<head><title>400 No required SSL certificate was sent</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<center>No required SSL certificate was sent</center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
Does anybody have a hint for me? I already expend 2 days trying to get docker pulling from the registry without success.