Works with self signed but does not work with internal CA

[joaoelvas]

Description

I ve set all up in my local machine with a self signed certificate, then I set it up in my corporate rserver with a self signed certificate, it worked again. Then I changed the certificate to a new certificate signed from our internal CA, now I can connect to Portus, and I can login in the registry, but I get SSLError when linking portus to the registry.

Steps to reproduce

1. Set FCDN and nginx (I used an URL that is correctly resolved on our internal DNS)
2. Copy all certidicates to /etc/docker/cert.d/{server url}:5000 ( rootCA.crt, intemediateCA.crt, and portus.crt)
3. docker-compose up
4. go to {server url} on the browser (from my local machine) shows as secure
5. create admin
6. set hostname to {server url}:5000
   7.1. Browser :
   OpenSSL::SSL::SSLError: could not stablish connection: SSL error You can skip this check by clicking on the "Skip remote checks" checkbox.
   7.2 Terminal logs:

registry_1_5868aac66eee | 2018/12/06 15:41:49 http: TLS handshake error from 172.18.0.1:54660: remote error: tls: unknown certificate authority
portus_1_514c193677b4 | OpenSSL::SSL::SSLError: could not stablish connection: SSL error

• Expected behavior: I expected portus to conect with registry like with a self signed certificate
• Actual behavior: OpenSSL::SSL::SSLError

Deployment information

I have a an ofline rootCA that signs 2 IntermediateCAs that are online, all this certificates are on the server both on the os and docker cert.d folder. I need this certificate to work otherwise I will not be able to get images from the registry on the production environment.

[joaoelvas]

Ok, I fixed this by adding the certificates to the secrets folder, this should be updated int the documentation.

[vlakshmi70]

Hi - could you pls share your config for TLS (self signed certs are fine for now) - your docker-compose.yml, the registry/config.yml, registry/init and did you only create portus.crt and portus.key as given in the examples/compose/README.md file??
Help is much appreciated.
Thanks,
lakshmi

[vlakshmi70]

I am currently getting the error as
I am having similar problem when I run with SSL (self signed)
registry_1_936961e5bfcc | 2019/05/16 14:36:14 http: TLS handshake error from 192.168.64.3:35312: remote error: tls: internal error
portus_1_c0ae2b982fd8 | OpenSSL::SSL::SSLError: could not stablish connection: SSL error
I am using the steps from the README.md file examples/compose

[vlakshmi70]

when I go to the server URL, I am able to get the login screen and I add the admin user name.
The problem happens when I try to add the registry.
Its not accepting registry:5000 or reg01.abc.com:5000
It says openssl could not establish connection

[Isuama]

If you have a DNS server add a hostentry to the resolv.conf, else edit your docker-compose.yml by adding host entries like,

extra_hosts:
- "reg01.abc.com: host IP"