{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/426","labels_url":"https://api.github.com/repos/docker/distribution/issues/426/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/426/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/426/events","html_url":"https://github.com/docker/distribution/issues/426","id":70486784,"number":426,"title":"S3 certificate must be added to docker daemon registry certificates","user":{"login":"sorenvind","id":164868,"avatar_url":"https://avatars.githubusercontent.com/u/164868?v=3","gravatar_id":"","url":"https://api.github.com/users/sorenvind","html_url":"https://github.com/sorenvind","followers_url":"https://api.github.com/users/sorenvind/followers","following_url":"https://api.github.com/users/sorenvind/following{/other_user}","gists_url":"https://api.github.com/users/sorenvind/gists{/gist_id}","starred_url":"https://api.github.com/users/sorenvind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sorenvind/subscriptions","organizations_url":"https://api.github.com/users/sorenvind/orgs","repos_url":"https://api.github.com/users/sorenvind/repos","events_url":"https://api.github.com/users/sorenvind/events{/privacy}","received_events_url":"https://api.github.com/users/sorenvind/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/distribution/labels/bug","name":"bug","color":"e11d21"}],"state":"closed","locked":false,"assignee":{"login":"aaronlehmann","id":10601430,"avatar_url":"https://avatars.githubusercontent.com/u/10601430?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronlehmann","html_url":"https://github.com/aaronlehmann","followers_url":"https://api.github.com/users/aaronlehmann/followers","following_url":"https://api.github.com/users/aaronlehmann/following{/other_user}","gists_url":"https://api.github.com/users/aaronlehmann/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronlehmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronlehmann/subscriptions","organizations_url":"https://api.github.com/users/aaronlehmann/orgs","repos_url":"https://api.github.com/users/aaronlehmann/repos","events_url":"https://api.github.com/users/aaronlehmann/events{/privacy}","received_events_url":"https://api.github.com/users/aaronlehmann/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/docker/distribution/milestones/8","html_url":"https://github.com/docker/distribution/milestones/Registry/2.1","labels_url":"https://api.github.com/repos/docker/distribution/milestones/8/labels","id":1026598,"number":8,"title":"Registry/2.1","description":"Items in this roadmap will be part of the registry 2.1 release.","creator":{"login":"stevvooe","id":120601,"avatar_url":"https://avatars.githubusercontent.com/u/120601?v=3","gravatar_id":"","url":"https://api.github.com/users/stevvooe","html_url":"https://github.com/stevvooe","followers_url":"https://api.github.com/users/stevvooe/followers","following_url":"https://api.github.com/users/stevvooe/following{/other_user}","gists_url":"https://api.github.com/users/stevvooe/gists{/gist_id}","starred_url":"https://api.github.com/users/stevvooe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevvooe/subscriptions","organizations_url":"https://api.github.com/users/stevvooe/orgs","repos_url":"https://api.github.com/users/stevvooe/repos","events_url":"https://api.github.com/users/stevvooe/events{/privacy}","received_events_url":"https://api.github.com/users/stevvooe/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":216,"state":"closed","created_at":"2015-03-18T04:15:41Z","updated_at":"2015-08-12T19:18:16Z","due_on":"2015-08-11T07:00:00Z","closed_at":"2015-08-12T19:18:16Z"},"comments":17,"created_at":"2015-04-23T18:59:53Z","updated_at":"2015-08-28T20:36:03Z","closed_at":"2015-08-03T23:36:55Z","body":"I'm trying to set up a Registry v2 backed by AWS S3 that uses self-signed client certificates and no further authentication. My setup so far works with the following (meaning that I can push and pull from it with a client):\r\n- registry running on AWS EC2\r\n- self-signed CA, server and client key\r\n- backed by unsecure S3 (i.e. secure: false in the config)\r\n\r\nMy config.yml is:\r\n```\r\nversion: 0.1\r\nstorage:\r\n    cache:\r\n        layerinfo: inmemory\r\n    s3:\r\n        accesskey: REDACTED\r\n        secretkey: REDACTED\r\n        region: eu-west-1\r\n        bucket: REDACTED\r\n        encrypt: false\r\n        secure: false\r\n        v4auth: true\r\n        rootdirectory: /registry2\r\nhttp:\r\n    addr: :5000\r\n    secret: REDACTED\r\n    debug:\r\n        addr: :5001\r\n    tls:\r\n        certificate: /go/src/github.com/docker/distribution/certs/domain.crt\r\n        key: /go/src/github.com/docker/distribution/certs/domain.key\r\n        clientcas:\r\n            - /go/src/github.com/docker/distribution/certs/ca.crt\r\n```\r\n\r\nHowever, I want the S3 connection to be secured. If I change secure: false to secure: true, it seems that the upload continues as expected, but after a while I get this message (note, this arrives *at the client*):\r\n```\r\n# docker push ec2-REDACTED.eu-west-1.compute.amazonaws.com:5000/hello-world:latest\r\nThe push refers to a repository [ec2-REDACTED.eu-west-1.compute.amazonaws.com:5000/hello-world] (len: 1)\r\n91c95931e552: Image push failed \r\nFATA[0000] Error pushing to registry: Head https://s3-eu-west-1.amazonaws.com/REDACTED/registry2/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJCQ2SRKBWG3CKEGA%2F20150423%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20150423T185546Z&X-Amz-Expires=1200&X-Amz-Signature=6423a34b004f84d4d0c7dc27b159130a192dc2efcedd43a1bdab081134e60fdd&X-Amz-SignedHeaders=host: x509: certificate signed by unknown authority \r\n```\r\n\r\nOn the same machine running docker, I can do:\r\n```\r\n# curl -v https://s3-eu-west-1.amazonaws.com\r\n* Rebuilt URL to: https://s3-eu-west-1.amazonaws.com/\r\n* Hostname was NOT found in DNS cache\r\n*   Trying 54.231.136.64...\r\n* Connected to s3-eu-west-1.amazonaws.com (54.231.136.64) port 443 (#0)\r\n* successfully set certificate verify locations:\r\n*   CAfile: none\r\n  CApath: /etc/ssl/certs\r\n* SSLv3, TLS handshake, Client hello (1):\r\n* SSLv3, TLS handshake, Server hello (2):\r\n* SSLv3, TLS handshake, CERT (11):\r\n* SSLv3, TLS handshake, Server key exchange (12):\r\n* SSLv3, TLS handshake, Server finished (14):\r\n* SSLv3, TLS handshake, Client key exchange (16):\r\n* SSLv3, TLS change cipher, Client hello (1):\r\n* SSLv3, TLS handshake, Finished (20):\r\n* SSLv3, TLS change cipher, Client hello (1):\r\n* SSLv3, TLS handshake, Finished (20):\r\n* SSL connection using ECDHE-RSA-AES128-SHA\r\n* Server certificate:\r\n* \t subject: C=US; ST=Washington; L=Seattle; O=Amazon.com, Inc.; CN=*.s3-eu-west-1.amazonaws.com\r\n* \t start date: 2014-10-02 00:00:00 GMT\r\n* \t expire date: 2015-09-05 23:59:59 GMT\r\n* \t subjectAltName: s3-eu-west-1.amazonaws.com matched\r\n* \t issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of use at https://www.verisign.com/rpa (c)10; CN=VeriSign Class 3 Secure Server CA - G3\r\n* \t SSL certificate verify ok.\r\n> GET / HTTP/1.1\r\n> User-Agent: curl/7.35.0\r\n> Host: s3-eu-west-1.amazonaws.com\r\n> Accept: */*\r\n> \r\n< HTTP/1.1 307 Temporary Redirect\r\n< x-amz-id-2: Zq93t62mf990ntJA69FZXAiSxFl/wtnXq+j63Zaf5DRljHjYH6jz+WKjH+VMfriIeRFmqqt46zI=\r\n< x-amz-request-id: CC1FD79D39F8D877\r\n< Date: Thu, 23 Apr 2015 18:21:06 GMT\r\n< Location: http://aws.amazon.com/s3/\r\n< Content-Length: 0\r\n* Server AmazonS3 is not blacklisted\r\n< Server: AmazonS3\r\n< \r\n* Connection #0 to host s3-eu-west-1.amazonaws.com left intact\r\n```\r\n\r\nThe last couple of lines in my registry log is:\r\n```\r\nINFO[1885] (*layerInfoCache).Fetch(\"sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4\")  blob.fetch.duration=5.331µs http.request.host=ec2-REDACTED.eu-west-1.compute.amazonaws.com:5000 http.request.id=b2ea8940-936e-4439-abf8-459a99cbdfc9 http.request.method=HEAD http.request.remoteaddr=10.121.25.208:60849 http.request.uri=/v2/hello-world/blobs/sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 http.request.useragent=docker/1.6.0 go/go1.4.2 git-commit/4749651 kernel/3.13.0-49-generic os/linux arch/amd64 instance.id=3d11069c-6573-46f3-bf4f-b08677af2a36 vars.digest=sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 vars.name=hello-world version=v2.0.0-32-g73960f4.m\r\nINFO[1885] Base.URLFor(\"/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data\")  trace.duration=278.387µs trace.file=/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go trace.func=github.com/docker/distribution/registry/storage/driver/base.(*Base).URLFor trace.id=4ac3fe2f-16d3-483e-9f76-d40c4d660885 trace.line=161\r\nINFO[1885] response completed                            http.request.host=ec2-REDACTED.eu-west-1.compute.amazonaws.com:5000 http.request.id=b2ea8940-936e-4439-abf8-459a99cbdfc9 http.request.method=HEAD http.request.remoteaddr=10.121.25.208:60849 http.request.uri=/v2/hello-world/blobs/sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 http.request.useragent=docker/1.6.0 go/go1.4.2 git-commit/4749651 kernel/3.13.0-49-generic os/linux arch/amd64 http.response.duration=2.846826ms http.response.status=307 http.response.written=0 instance.id=3d11069c-6573-46f3-bf4f-b08677af2a36 version=v2.0.0-32-g73960f4.m\r\n10.121.25.208 - - [23/Apr/2015:18:55:46 +0000] \"HEAD /v2/hello-world/blobs/sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 HTTP/1.1\" 307 0 \"\" \"docker/1.6.0 go/go1.4.2 git-commit/4749651 kernel/3.13.0-49-generic os/linux arch/amd64\"\r\n```\r\n\r\nI really have no idea what's going on here. Is it possible that somehow the S3 storage driver is using my certificate or CA chain to try to verify the https response from S3 (and the error is forwarded to my client)? Or is this a problem in the docker client (but why will that end up knowing about S3)?"},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/135882342","html_url":"https://github.com/docker/distribution/issues/426#issuecomment-135882342","issue_url":"https://api.github.com/repos/docker/distribution/issues/426","id":135882342,"user":{"login":"dmp42","id":332946,"avatar_url":"https://avatars.githubusercontent.com/u/332946?v=3","gravatar_id":"","url":"https://api.github.com/users/dmp42","html_url":"https://github.com/dmp42","followers_url":"https://api.github.com/users/dmp42/followers","following_url":"https://api.github.com/users/dmp42/following{/other_user}","gists_url":"https://api.github.com/users/dmp42/gists{/gist_id}","starred_url":"https://api.github.com/users/dmp42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmp42/subscriptions","organizations_url":"https://api.github.com/users/dmp42/orgs","repos_url":"https://api.github.com/users/dmp42/repos","events_url":"https://api.github.com/users/dmp42/events{/privacy}","received_events_url":"https://api.github.com/users/dmp42/received_events","type":"User","site_admin":false},"created_at":"2015-08-28T20:36:03Z","updated_at":"2015-08-28T20:36:03Z","body":"@stevvooe do you think we should update the documentation about self-signed certs to bundle the amazon cert?"}}