Docker images and SSL certificates - docker

Question

As a neophyte to Docker and SSL, I can't get Docker to expose a secure (443) port no matter how hard I try, and it keeps giving me a certificate error...it wants one.
But search as I might on the internet I can't find any simple, plain language explanation of how to do this. Most of what I see assumes you already know Docker and SSL, and the rest are all edge cases - people trying to figure out how to do things outside the box.
Right now I'd just be happy with the box.
All I need to know is three things:
How to create a self signed certificate (I think I've done this, I just want to be sure I did it right).
How to get it into a Docker image at build (Dockerfile command?)
How to tell my service (inside the container) and my client (from outside the container) to use the secure SSL port (443) by way of the certificate when communicating accross the container boundary.
Can anyone give me a simple "...do this, then this..." explanation. I swear I'm not stupid, I can take it from there.

Answer 1

I'm not sure this is programming or development -- containerization has made the boundary very fuzzy. But no one has voted to close, or answered, so I'll try an answer, though frankly I'm skeptical it'll really help.
First to be clear, docker doesn't implement SSL/TLS for a container, or do anything with certificates. Docker does networking at the TCP/IP level only. An application in a container can do SSL/TLS the same -- or very nearly the same -- as when running outside. Your second formulation -- "my service (inside the container) ... to use SSL ..." -- is the correct one.
Second, 443 is the standard port not just for SSL/TLS but for HTTPS = HTTP over SSL/TLS. You aren't clear if that's what you want, or if you want any of the hundreds of other protocols that use SSL/TLS and could use 443, although most usually don't. I'll answer the former because the latter would be much more work, and if that's not what you wanted you should have been clearer.
So restating, you want a self-signed cert (and matching privatekey) and an HTTPS server on 443 in a container, and a client on the host.
There are many hundreds of ways to create a self-signed cert, and key, depending partly on what kind of server you want to run (especially as to the file format) and what kind(s) of client(s) you want to connect to it (especially as to some fields in the cert). Based on my choices below I want OpenSSL file format(s), and the easiest way is:
$ openssl req -newkey rsa:2048 -nodes -keyout key -x509 -sha256 -days 3650 -subj /CN=localhost -out crt
Now, the easiest trivial HTTPS server I can write is in nodejs, for which hub conveniently has images, so to run the server in a container I do:
$ echo "let rf=require('fs').readFileSync; require('https').createServer({key:rf('/app/key'),cert:rf('/app/crt')},(req,res)=>{res.end('yay!\n')}).listen(443); console.log('ready\n')" \
| sudo docker run -ip443:443 -v$PWD:/app node:lts-alpine
ready
-v$PWD:/app makes the key and crt files I created with openssl available to the nodejs server code. -p443:443 makes the port 443 created in the container by that code accessible as 443 on the host. Note there must not be any other server on the host using 443 (or any other container mapping to it).
Finally, the easiest client to use with a PEM-format certificate and an arbitrary response is curl in a different terminal on the same host:
$ curl -v --cacert crt https://localhost
* Rebuilt URL to: https://localhost/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Unknown (8):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Client hello (1):
* TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: CN=localhost
* start date: Feb 23 08:09:00 2022 GMT
* expire date: Feb 21 08:09:00 2032 GMT
* common name: localhost (matched)
* issuer: CN=localhost
* SSL certificate verify ok.
* TLSv1.3 (OUT), TLS Unknown, Unknown (23):
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/7.58.0
> Accept: */*
>
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS Unknown, Unknown (23):
< HTTP/1.1 200 OK
< Date: Wed, 23 Feb 2022 08:09:30 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
< Content-Length: 5
<
yay!
* Connection #0 to host localhost left intact
$
The yay! in the next to last line is the response from the server (to any request I make).