Bug 1466427 - Registry console fails to accept self-signed cert
Summary: Registry console fails to accept self-signed cert
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Registry Console
Version: 3.5.0
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
: 3.11.z
Assignee: Martin Pitt
QA Contact: Yanping Zhang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-06-29 14:38 UTC by Marko Myllynen
Modified: 2020-05-13 18:09 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-05-13 18:09:08 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Marko Myllynen 2017-06-29 14:38:14 UTC
Description of problem:
In a containerized 3.5 installation Docker and other parts work well with a self-signed cert after doing something like:

    - name: Create Docker registry certificate directory
      file: path=/etc/docker/certs.d/{{ openshift_docker_additional_registries }} state=directory
      when: openshift_docker_additional_registries is defined

    - name: Copy Docker registry certificate for Docker
      copy: src=cert.crt dest=/etc/docker/certs.d/{{ openshift_docker_additional_registries }} follow=yes
      when: openshift_docker_additional_registries is defined

    - name: Copy Docker registry certificate for OpenShift tools
      copy: src=cert.crt dest=/etc/pki/ca-trust/source/anchors/registry.crt follow=yes
      register: certificate_update
      when: openshift_docker_additional_registries is defined

    - name: Update CA trust store
      command: /usr/bin/update-ca-trust
      when: certificate_update | changed

However, when accessing the registry console, and clicking Images on the left, the following error is displayed:

 Internal error occurred: Get https://registry.example.com:5000/v2/: x509: certificate signed by unknown authority. Timestamp: 2017-06-29T14:08:39Z Error count: 2 Edit image stream 

Once configured on the host, the registry-console container should recognize the self-signed cert as well, like other components do.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Marko Myllynen 2017-06-29 14:41:09 UTC
(In reply to Marko Myllynen from comment #0)
> 
> However, when accessing the registry console, and clicking Images on the
> left, the following error is displayed:
> 
>  Internal error occurred: Get https://registry.example.com:5000/v2/: x509:
> certificate signed by unknown authority. Timestamp: 2017-06-29T14:08:39Z
> Error count: 2 Edit image stream 

Minor clarification: to see the error, click on Images and then try to expand the default/registry-console shown on the right. Thanks.

Comment 7 Martin Pitt 2020-05-13 18:09:08 UTC
Not relevant any more for current OpenShift, and this is indeed quite stale, so closing. Thanks!


Note You need to log in before you can comment on or make changes to this bug.