Mixing
Fail to pull docker image using Docker for Windows via SSL
7
I use docker engine 2.0.0.0-win77 (28777). On my macOS I have succeeded in pulling images from my company's private docker registry. Then I want to do this on my Windows machine. Before I do anything, I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: x509: certificate signed by unknown authority
Then, I imported the certificates into my Windows user certificates store.
Now I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
After this failure I have tried:
- Imported the certificates into my Windows global certificates store.
Copied the files
client.cert,client.keyandca.crtto my Windows 10 into:
C:ProgramDataDockercerts.d<company.docker.url>C:Users<user>.dockercerts.d<company.docker.url>
Sadly, I still get this:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
Two more things to notice:
- If I switch to Windows Containers, I can successfully login or pull images, only fails with Linux Containers version.
- My private cert is signed by an intermediate cert, and the intermediate cert is contained in my
client.cert.
Some references I have read:
- Verify repository client with certificates
- Unable to connect to registry with client certificate signed by intermediate certificate
- Docker Registry SSL CA cert location on windows?
- Docker for Windows FAQ of certificates
docker ssl windows-10
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
add a comment |
7
I use docker engine 2.0.0.0-win77 (28777). On my macOS I have succeeded in pulling images from my company's private docker registry. Then I want to do this on my Windows machine. Before I do anything, I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: x509: certificate signed by unknown authority
Then, I imported the certificates into my Windows user certificates store.
Now I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
After this failure I have tried:
- Imported the certificates into my Windows global certificates store.
Copied the files
client.cert,client.keyandca.crtto my Windows 10 into:
C:ProgramDataDockercerts.d<company.docker.url>C:Users<user>.dockercerts.d<company.docker.url>
Sadly, I still get this:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
Two more things to notice:
- If I switch to Windows Containers, I can successfully login or pull images, only fails with Linux Containers version.
- My private cert is signed by an intermediate cert, and the intermediate cert is contained in my
client.cert.
Some references I have read:
- Verify repository client with certificates
- Unable to connect to registry with client certificate signed by intermediate certificate
- Docker Registry SSL CA cert location on windows?
- Docker for Windows FAQ of certificates
docker ssl windows-10
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
Have you tried explicitly specifying the tls dir to docker client?docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli
– Robert
Jul 2 '18 at 13:37
@Robert, I don't think this is the issue because I think--tls*options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.
– Elderry
Jul 3 '18 at 3:03
@Robert I also tried the command you suggested and get:error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it.You can see it tries to connect 127.0.0.1.
– Elderry
Jul 3 '18 at 3:04
I see, you're right.
– Robert
Jul 3 '18 at 8:17
add a comment |
7
7
7
2
I use docker engine 2.0.0.0-win77 (28777). On my macOS I have succeeded in pulling images from my company's private docker registry. Then I want to do this on my Windows machine. Before I do anything, I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: x509: certificate signed by unknown authority
Then, I imported the certificates into my Windows user certificates store.
Now I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
After this failure I have tried:
- Imported the certificates into my Windows global certificates store.
Copied the files
client.cert,client.keyandca.crtto my Windows 10 into:
C:ProgramDataDockercerts.d<company.docker.url>C:Users<user>.dockercerts.d<company.docker.url>
Sadly, I still get this:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
Two more things to notice:
- If I switch to Windows Containers, I can successfully login or pull images, only fails with Linux Containers version.
- My private cert is signed by an intermediate cert, and the intermediate cert is contained in my
client.cert.
Some references I have read:
- Verify repository client with certificates
- Unable to connect to registry with client certificate signed by intermediate certificate
- Docker Registry SSL CA cert location on windows?
- Docker for Windows FAQ of certificates
docker ssl windows-10
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
I use docker engine 2.0.0.0-win77 (28777). On my macOS I have succeeded in pulling images from my company's private docker registry. Then I want to do this on my Windows machine. Before I do anything, I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: x509: certificate signed by unknown authority
Then, I imported the certificates into my Windows user certificates store.
Now I have:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
After this failure I have tried:
- Imported the certificates into my Windows global certificates store.
Copied the files
client.cert,client.keyandca.crtto my Windows 10 into:
C:ProgramDataDockercerts.d<company.docker.url>C:Users<user>.dockercerts.d<company.docker.url>
Sadly, I still get this:
> docker pull <company.docker.url>/<some image>
Error response from daemon: Get https://<company.docker.url>/v2/: remote error: tls: handshake failure
Two more things to notice:
- If I switch to Windows Containers, I can successfully login or pull images, only fails with Linux Containers version.
- My private cert is signed by an intermediate cert, and the intermediate cert is contained in my
client.cert.
Some references I have read:
- Verify repository client with certificates
- Unable to connect to registry with client certificate signed by intermediate certificate
- Docker Registry SSL CA cert location on windows?
- Docker for Windows FAQ of certificates
docker ssl windows-10
docker ssl windows-10
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
edited Nov 22 '18 at 1:24
Elderry
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
asked Jun 28 '18 at 9:21
ElderryElderry
57821532
57821532
Have you tried explicitly specifying the tls dir to docker client?docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli
– Robert
Jul 2 '18 at 13:37
@Robert, I don't think this is the issue because I think--tls*options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.
– Elderry
Jul 3 '18 at 3:03
@Robert I also tried the command you suggested and get:error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it.You can see it tries to connect 127.0.0.1.
– Elderry
Jul 3 '18 at 3:04
I see, you're right.
– Robert
Jul 3 '18 at 8:17
add a comment |
Have you tried explicitly specifying the tls dir to docker client?docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli
– Robert
Jul 2 '18 at 13:37
@Robert, I don't think this is the issue because I think--tls*options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.
– Elderry
Jul 3 '18 at 3:03
@Robert I also tried the command you suggested and get:error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it.You can see it tries to connect 127.0.0.1.
– Elderry
Jul 3 '18 at 3:04
I see, you're right.
– Robert
Jul 3 '18 at 8:17
Have you tried explicitly specifying the tls dir to docker client?
docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli– Robert
Jul 2 '18 at 13:37
Have you tried explicitly specifying the tls dir to docker client?
docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli– Robert
Jul 2 '18 at 13:37
@Robert, I don't think this is the issue because I think
--tls* options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.– Elderry
Jul 3 '18 at 3:03
@Robert, I don't think this is the issue because I think
--tls* options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.– Elderry
Jul 3 '18 at 3:03
@Robert I also tried the command you suggested and get:
error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it. You can see it tries to connect 127.0.0.1.– Elderry
Jul 3 '18 at 3:04
@Robert I also tried the command you suggested and get:
error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it. You can see it tries to connect 127.0.0.1.– Elderry
Jul 3 '18 at 3:04
I see, you're right.
– Robert
Jul 3 '18 at 8:17
I see, you're right.
– Robert
Jul 3 '18 at 8:17
add a comment |
2 Answers
2
active
oldest
votes
0
I would try two things:
- Did you tried: docker login first before to pull the images?
- Restart the client and repeat.
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
add a comment |
0
I had this error on windows, too. In my case, restarting the docker daemon helped.
answered Jun 28 '18 at 12:19
mschomscho
1727
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f51079171%2ffail-to-pull-docker-image-using-docker-for-windows-via-ssl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
I would try two things:
- Did you tried: docker login first before to pull the images?
- Restart the client and repeat.
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
add a comment |
0
I would try two things:
- Did you tried: docker login first before to pull the images?
- Restart the client and repeat.
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
add a comment |
0
0
0
I would try two things:
- Did you tried: docker login first before to pull the images?
- Restart the client and repeat.
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
I would try two things:
- Did you tried: docker login first before to pull the images?
- Restart the client and repeat.
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
answered Jun 28 '18 at 12:17
LucasPCLucasPC
983
983
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
add a comment |
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
add a comment |
0
I had this error on windows, too. In my case, restarting the docker daemon helped.
answered Jun 28 '18 at 12:19
mschomscho
1727
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
add a comment |
0
I had this error on windows, too. In my case, restarting the docker daemon helped.
answered Jun 28 '18 at 12:19
mschomscho
1727
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
add a comment |
0
0
0
I had this error on windows, too. In my case, restarting the docker daemon helped.
answered Jun 28 '18 at 12:19
mschomscho
1727
I had this error on windows, too. In my case, restarting the docker daemon helped.
answered Jun 28 '18 at 12:19
mschomscho
1727
answered Jun 28 '18 at 12:19
mschomscho
1727
answered Jun 28 '18 at 12:19
mschomscho
1727
answered Jun 28 '18 at 12:19
mschomscho
1727
1727
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
add a comment |
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Tried with no luck, same error.
– Elderry
Jun 28 '18 at 12:23
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
Did you use the Windows containers? I found that I would only fail while using Linux Containers.
– Elderry
Jul 1 '18 at 14:56
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f51079171%2ffail-to-pull-docker-image-using-docker-for-windows-via-ssl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Have you tried explicitly specifying the tls dir to docker client?
docker --tls-cert=C:ProgramDataDockercerts.ddocker.company.netclient.cert --tls-key=C:ProgramDataDockercerts.ddocker.company.netclient.key --tls-cacert=C:ProgramDataDockercerts.ddocker.company.netca.crt pull <company.docker.url>/<some image>. Ref: docs.docker.com/engine/reference/commandline/cli– Robert
Jul 2 '18 at 13:37
@Robert, I don't think this is the issue because I think
--tls*options are used for connecting to docker daemon, which is running in localhost. My problem is fail to connect the remote docker registry.– Elderry
Jul 3 '18 at 3:03
@Robert I also tried the command you suggested and get:
error during connect: Post https://127.0.0.1:2376/v1.37/images/create?fromImage=docker.compayn.net%2Ftradeshift-proxy&tag=148fbf3b3db5849f73675147c0f14def8766ee21: dial tcp 127.0.0.1:2376: connectex: No connection could be made because the target machine actively refused it.You can see it tries to connect 127.0.0.1.– Elderry
Jul 3 '18 at 3:04
I see, you're right.
– Robert
Jul 3 '18 at 8:17