What port do swarm mode controllers listen to?

I’m trying out the new 1.12 swarm mode and created a cluster with 7 nodes (3 managers and 4 workers). The cluster itself is working fine, but I can’t seem to figure out how to issue commands to the manager(s) without being on the manager VMs directly.

What do I set DOCKER_HOST to in order to contact a manager node? I tried DOCKER_HOST=tcp://(manager ip):2375, :2376, and :2377 without success. With :2377, I get the following response.

Get http://(manager ip):2377/v1.24/info: malformed HTTP response "\x15\x03\x01\x00\x02\x02".
* Are you trying to connect to a TLS-enabled daemon without TLS?

Firewall ports are open for 2375 to 2377. Of those, netstat only shows 2377 being listened on. I’m rather confused about this.

Ah, I just realized I need to specify DOCKER_TLS_VERIFY=“1”.