@@ -18,16 +18,18 @@ In the daemon mode, it will only allow connections from clients
18
18
authenticated by a certificate signed by that CA. In the client mode,
19
19
it will only connect to servers with a certificate signed by that CA.
20
20
21
- > ** Warning** :
21
+ > Advanced topic
22
+ >
22
23
> Using TLS and managing a CA is an advanced topic. Please familiarize yourself
23
24
> with OpenSSL, x509 and TLS before using it in production.
24
- {:.warning }
25
+ {:.important }
25
26
26
- > ** Warning** :
27
+ > Only works on Linux
28
+ >
27
29
> These TLS commands will only generate a working set of certificates on Linux.
28
30
> macOS comes with a version of OpenSSL that is incompatible with the
29
31
> certificates that Docker requires.
30
- {:.warning }
32
+ {:.important }
31
33
32
34
## Create a CA, server and client keys with OpenSSL
33
35
@@ -43,6 +45,7 @@ First, on the **Docker daemon's host machine**, generate CA private and public k
43
45
e is 65537 (0x10001)
44
46
Enter pass phrase for ca-key.pem:
45
47
Verifying - Enter pass phrase for ca-key.pem:
48
+
46
49
$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
47
50
Enter pass phrase for ca-key.pem:
48
51
You are about to be asked to enter information that will be incorporated
@@ -72,6 +75,7 @@ name) matches the hostname you will use to connect to Docker:
72
75
.....................................................................++
73
76
.................................................................................................++
74
77
e is 65537 (0x10001)
78
+
75
79
$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
76
80
77
81
Next, we're going to sign the public key with our CA:
@@ -113,6 +117,7 @@ request:
113
117
.........................................................++
114
118
................++
115
119
e is 65537 (0x10001)
120
+
116
121
$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
117
122
118
123
To make the key suitable for client authentication, create an extensions
@@ -156,7 +161,9 @@ providing a certificate trusted by our CA:
156
161
To be able to connect to Docker and validate its certificate, you now
157
162
need to provide your client keys, certificates and trusted CA:
158
163
159
- > ** Note** : This step should be run on your Docker client machine. As such, you
164
+ > Run it on the client machine
165
+ >
166
+ > This step should be run on your Docker client machine. As such, you
160
167
> need to copy your CA certificate, your server certificate, and your client
161
168
> certificate to that machine.
162
169
@@ -186,6 +193,7 @@ the files to the `.docker` directory in your home directory -- and set the
186
193
187
194
$ mkdir -pv ~/.docker
188
195
$ cp -v {ca,cert,key}.pem ~/.docker
196
+
189
197
$ export DOCKER_HOST=tcp://$HOST:2376 DOCKER_TLS_VERIFY=1
190
198
191
199
Docker will now connect securely by default:
0 commit comments