{"action":"created","issue":{"url":"https://api.github.com/repos/docker/machine/issues/2111","labels_url":"https://api.github.com/repos/docker/machine/issues/2111/labels{/name}","comments_url":"https://api.github.com/repos/docker/machine/issues/2111/comments","events_url":"https://api.github.com/repos/docker/machine/issues/2111/events","html_url":"https://github.com/docker/machine/issues/2111","id":113993703,"number":2111,"title":"Certificate confusion in /var/lib/boot2docker/ (1.9.0-rc2)","user":{"login":"jamshid","id":8549,"avatar_url":"https://avatars.githubusercontent.com/u/8549?v=3","gravatar_id":"","url":"https://api.github.com/users/jamshid","html_url":"https://github.com/jamshid","followers_url":"https://api.github.com/users/jamshid/followers","following_url":"https://api.github.com/users/jamshid/following{/other_user}","gists_url":"https://api.github.com/users/jamshid/gists{/gist_id}","starred_url":"https://api.github.com/users/jamshid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamshid/subscriptions","organizations_url":"https://api.github.com/users/jamshid/orgs","repos_url":"https://api.github.com/users/jamshid/repos","events_url":"https://api.github.com/users/jamshid/events{/privacy}","received_events_url":"https://api.github.com/users/jamshid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/machine/milestones/5","html_url":"https://github.com/docker/machine/milestones/0.5.0","labels_url":"https://api.github.com/repos/docker/machine/milestones/5/labels","id":1219188,"number":5,"title":"0.5.0","description":"","creator":{"login":"nathanleclaire","id":1476820,"avatar_url":"https://avatars.githubusercontent.com/u/1476820?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanleclaire","html_url":"https://github.com/nathanleclaire","followers_url":"https://api.github.com/users/nathanleclaire/followers","following_url":"https://api.github.com/users/nathanleclaire/following{/other_user}","gists_url":"https://api.github.com/users/nathanleclaire/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanleclaire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanleclaire/subscriptions","organizations_url":"https://api.github.com/users/nathanleclaire/orgs","repos_url":"https://api.github.com/users/nathanleclaire/repos","events_url":"https://api.github.com/users/nathanleclaire/events{/privacy}","received_events_url":"https://api.github.com/users/nathanleclaire/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":72,"state":"open","created_at":"2015-07-21T21:58:41Z","updated_at":"2015-10-29T17:12:37Z","due_on":"2015-10-30T07:00:00Z","closed_at":null},"comments":2,"created_at":"2015-10-29T07:10:03Z","updated_at":"2015-10-29T19:28:03Z","closed_at":null,"body":"I installed docker toolbox 1.9.0-rc2 https://github.com/docker/toolbox/releases/tag/v1.9.0-rc2 on my OS X desktop (192.168.2.5). I am trying to connect to the docker vm (192.168.99.100:2376) via an ssh tunnel running on my notebook. \r\n```\r\nssh -nNT -L \"2205:192.168.99.100:22\" 192.168.2.5 &   # ssh proxy so I can copy the docker certs\r\nmkdir -p ~/.docker-tls-desktop ; sshpass -p \"tcuser\" ssh -p 2205 docker@127.0.0.1 sudo tar -cf - -C /var/lib/boot2docker/tls ca.pem cert.pem key.pem | tar -xvf - -C ~/.docker-tls-desktop\r\nssh -nNT -L \"23905:192.168.99.100:2376\" 192.168.2.5 &  # docker port proxy\r\n```\r\nI then set these docker env variables to connect via the docker port proxy:\r\n```\r\nexport DOCKER_HOST=\"tcp://127.0.0.1:23905\"\r\nexport DOCKER_CERT_PATH=~/.docker-tls-desktop/\r\nexport DOCKER_TLS_VERIFY=1\r\n```\r\nBut the docker client on my notebook still cannot talk to the docker server in the VM on my desktop:\r\n```\r\n$ docker ps\r\nAn error occurred trying to connect: Get https://127.0.0.1:23905/v1.20/containers/json: x509: certificate is valid for 192.168.99.100, not 127.0.0.1\r\n```\r\nLogging into the VM, according to tls/hostnames the docker cert should cover ip 127.0.0.1:\r\n```\r\ndocker@default:~$ sudo cat /var/lib/boot2docker/tls/hostnames\r\ndefault,127.0.0.1,10.0.2.15,192.168.99.100\r\n```\r\nbut the certs in `tls` are *not actually used*. Instead, the ones in /var/lib/boot2docker/*.pem are used:\r\n```\r\ndocker@default:~$ cat /var/lib/boot2docker/profile \r\n...\r\nCACERT=/var/lib/boot2docker/ca.pem\r\nSERVERKEY=/var/lib/boot2docker/server-key.pem\r\nSERVERCERT=/var/lib/boot2docker/server.pem\r\n```\r\nWhy?\r\n\r\nAnyway, copying the three files (including renaming serverkey.pem to server-key.pem) from /var/lib/boot2docker/tls to /var/lib/boot2docker/ and \"sudo /etc/init.d/docker restart\" fixed the cert validation error.\r\n\r\nPS: why is there both /var/lib/boot2docker/etc/hostname and /var/lib/boot2docker/tls/hostnames? Seems etc/hostname and the root level *.pem's should go away, use only the files in the tls directory.\r\n\r\nPS2: if there's a better way to do this, let me know. Maybe I can manually(?) create a docker-machine configuration for this, but seems I still need a ssh tunnel to proxy the VM, unless I were to port-forward the VM's docker port on the host (my desktop) ip."},"comment":{"url":"https://api.github.com/repos/docker/machine/issues/comments/152294577","html_url":"https://github.com/docker/machine/issues/2111#issuecomment-152294577","issue_url":"https://api.github.com/repos/docker/machine/issues/2111","id":152294577,"user":{"login":"nathanleclaire","id":1476820,"avatar_url":"https://avatars.githubusercontent.com/u/1476820?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanleclaire","html_url":"https://github.com/nathanleclaire","followers_url":"https://api.github.com/users/nathanleclaire/followers","following_url":"https://api.github.com/users/nathanleclaire/following{/other_user}","gists_url":"https://api.github.com/users/nathanleclaire/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanleclaire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanleclaire/subscriptions","organizations_url":"https://api.github.com/users/nathanleclaire/orgs","repos_url":"https://api.github.com/users/nathanleclaire/repos","events_url":"https://api.github.com/users/nathanleclaire/events{/privacy}","received_events_url":"https://api.github.com/users/nathanleclaire/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T19:28:02Z","updated_at":"2015-10-29T19:28:02Z","body":"Dupe (I think?) of: https://github.com/docker/machine/issues/2018\r\n\r\n> PS2: if there's a better way to do this, let me know.\r\n\r\n@jamshid, by \"this\" do you mean \"forward the daemon port to localhost\"?"}}