I am trying to scan a docker image using "jf docker scan DOCKER_IMAGE:TAG --insecure-tls=true" but an error "x509: certificate signed by unknown authority" is showing up,
Here is the log :
[Warn] (Attempt 1) - Failure occurred while sending GET request to https://THE_URL/api/system/version: Get "https:///api/system/version": x509: certificate signed by unknown authority
[Info] executor timeout after 3 attempts with 0 milliseconds wait intervals
INFORMATION: When I try to send a Curl request from the terminal to the URL it works.
The issue here is that JFrog CLI cannot get the certs to trust the connection and fails. I would suggest referring to this wiki first to understand the JFrog CLI's cert validation. Overall, you should simply add the pem file of the cert to the JFROG_CLI_HOME/security/certs directory.
Related
After creating a private docker registry on one of my machines, I try to push an image to it but it throws the error: Get "https://host.domain/v2/": x509: certificate signed by unknown authority
The registry was created according to the official docker documentation. If I request the same url within safari or chrome, the request gets resolved successfully, showing that the certificate is valid.
So I'm wondering: what does docker do differently that it can't validate my certificate?
Many thanks in advice!
Solved the issue: it seems that if your certificate issuer provides an intermediate certificate EXPLICITLY, it's required to chain the domain.crt and intermediate.crt by running cat domain.cry intermediate.crt > concat-domain.crt (for example).
Instruction coming from official docker documentation.
I was trying to install Harbor: Private Docker Registry with Paid SSL from Sectigo(Comodo).
But when I install, I can see it was successful in web page, but not in docker login.
When I tried to docker login ~~~, then it says Error response from daemon: Get https://docker.siadev.kr/v2/: x509: certificate signed by unknown authority
What I received from SSL provider are these.
{domain}.crt, {domain}.key, AAACertificateServices.crt, AddTrustExternalCARoot.crt, COMODORSAAddTrustCA.crt, COMODORSADomainValidationSecureServerCA.crt, SectigoRSAAddTrustCA.crt, SectigoRSADomainValidationSecureServerCA.crt, rsa-dv.chain-bundle.pem
And docker says it supports ca.crt, {domain}.cert, {domain}.key.
What crt files do I have to concat?
I placed those like,
/etc/docker/certs.d/{domain}/{domain}.cert
/etc/docker/certs.d/{domain}/{domain}.key
/etc/docker/certs.d/{domain}/ca.crt
.
If I try to login with ip or another domain, then it says Error response from daemon: Get https://{domain}/v2/: x509: certificate is valid for {domain}, not {fake_domain}.
So I assume that they are in the right place, and the problem is from wrong combine of ca.crt.
I'm not sure it's going to solve your problem but I think you should put your certificate in
/etc/docker/certs.d/$MY_REGISTR_DOMAIN:REGISTR_PORT/
folder. That's where I placed mine (they are self signed) and it works.
I am getting an error when I am trying to pull docker image.
We have set up the proxy, and in our organization we have explicit proxy, so to access external server we cannot do without setting it.
[root#DX2821 city]# docker pull hellow-world
Using default tag: latest
Error response from daemon:
Get https://registry-1.docker.io/v2/: x509: certificate signed by
unknown authority
I had exactly the same problem in my company.
We have also a proxy. For monitoring our https connection to avoid malwares, our proxy creates a certificate on the fly for the secured connection between a station and the proxy. Then another secured connection is done between the proxy and the website. The message indicates that the certificate produced by the proxy was signed by an unknown authority: the "fake authority" which generates the certificates.
For solving the problem, I had to install the root certificate of this "fake authority" in /usr/share/ca-certificates (for a linux station)
and then:
> update-ca-certificates
I'm new in docker and I testing some stuffs. I had installed a UCP to upload my images but when I wanted login to UCP with CLI showed this error:
Error response from daemon: Get https://x.x.x.x/v1/users/: x509:
certificate signed by unknown authority
I searched this error and I found many responses (many differents responses) after that, I finished to install the DTR and I could login without a problem.
My questions is:
After I had installed just the UCP I tried connect to this, the error showed. So, Is necessary have installed DTR to correctly connect?, or, Could it be another problem?
Thanks for your help!
" I had installed a UCP to upload my images". What does this mean? The DTR should be part of your UCP Swarm and that is where you push your images to.
So if you are getting this error when trying to push your image to one of the repository in DTR, then try the below steps(assuming your worker nodes are window 2016 servers).
Create certificate in DTR node
Copy the certificate to the docker node or which ever machine from which you are trying to push the image
Open MMC
Add certificates (use Computer account)
Open Trusted Root Certification Authorities
Click More action on the right and click import
Upload the copied certificate and finish
Try "docker login" command with your DTR url and make sure you able to login without an issue
I have a Dockerfile and one of the actions is to add an xml file downloaded from a stash ( internal network) repository. We use self certs for our stash. I am getting this error "Centos docker x509: certificate signed by unknown authority" at the step when it tries to execute the ADD command (which results in a http GET)
Any solution to by pass?