{"action":"closed","issue":{"url":"https://api.github.com/repos/docker/compose/issues/1427","labels_url":"https://api.github.com/repos/docker/compose/issues/1427/labels{/name}","comments_url":"https://api.github.com/repos/docker/compose/issues/1427/comments","events_url":"https://api.github.com/repos/docker/compose/issues/1427/events","html_url":"https://github.com/docker/compose/issues/1427","id":77789331,"number":1427,"title":"`routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed` on CentOS with docker 1.5.0 client and server","user":{"login":"grahamc","id":76716,"avatar_url":"https://avatars.githubusercontent.com/u/76716?v=3","gravatar_id":"","url":"https://api.github.com/users/grahamc","html_url":"https://github.com/grahamc","followers_url":"https://api.github.com/users/grahamc/followers","following_url":"https://api.github.com/users/grahamc/following{/other_user}","gists_url":"https://api.github.com/users/grahamc/gists{/gist_id}","starred_url":"https://api.github.com/users/grahamc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grahamc/subscriptions","organizations_url":"https://api.github.com/users/grahamc/orgs","repos_url":"https://api.github.com/users/grahamc/repos","events_url":"https://api.github.com/users/grahamc/events{/privacy}","received_events_url":"https://api.github.com/users/grahamc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-05-18T20:15:48Z","updated_at":"2015-05-28T08:17:57Z","closed_at":"2015-05-28T08:17:57Z","body":"\r\nServer:\r\n - CoreOS Stable\r\n - Docker 1.5.0\r\n\r\nClient:\r\n - CentOS 6.6, 64-bit\r\n - kernel 2.6.32-042stab105.14\r\n - Docker client 1.5.0\r\n - docker-compose 1.2.0\r\n - SSL certificates placed at `~/.docker/{ca.pem,cert.pem,key.pem}`\r\n - `DOCKER_HOST=tcp://docker-builder:2376`\r\n - `DOCKER_TLS_VERIFY=1`\r\n\r\nUsing the following Makefile to build the SSL certificates:\r\n```makefile\r\n#!/bin/bash\r\n\r\nSERVER=docker-builder\r\n\r\nclean:\r\n\trm ca.* server.* client.* *.key\r\n\r\nall: ca.crt server.crt client.crt\r\n\r\n%.key:\r\n\topenssl genrsa -out $@ 4096\r\n\r\nca.crt: ca.key\r\n\topenssl req -new -x509 -days 365 -key ca.key -sha256 -out ca.crt \\\r\n\t\t-subj \"/C=US/ST=Texas/L=Austin/O=Abc123/OU=Operations/CN=${SERVER}/emailAddress=ops@abc123.io\"\r\n\r\nserver.csr: server.key\r\n\topenssl req -new -key server.key -out server.csr \\\r\n\t\t-subj \"/C=US/ST=Texas/L=Austin/O=Abc123/OU=Operations/CN=${SERVER}/emailAddress=ops@abc123.io\"\r\n\r\nserver.crt: ca.key ca.crt server.csr\r\n\topenssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key \\\r\n\t\t-CAcreateserial -out server.crt\r\n\r\nclient.csr: client.key\r\n\topenssl req -new -key client.key -out client.csr \\\r\n\t\t-subj \"/C=US/ST=Texas/L=Austin/O=Abc123/OU=Operations/CN=Docker Client/emailAddress=ops@abc123.io\"\r\n\r\nclient.ext.cnf:\r\n\techo \"extendedKeyUsage = clientAuth\" > client.ext.cnf\r\n\r\nclient.crt: client.csr ca.crt ca.key client.ext.cnf\r\n\topenssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key \\\r\n\t\t-CAcreateserial -out client.crt -extfile client.ext.cnf\r\n```\r\n\r\nUsing the `docker` client I have good success accessing the remote docker server. We call the remote server up to a hundred thousand times a day with good success.\r\n\r\nAttempting to use `docker-compose`, installed either via curl OR `pip install --upgrade` with python 2.7, we get an SSL error:\r\n\r\n```\r\n$ docker-compose up -d\r\nSSL error: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed\r\n```\r\n\r\nThis is the case after manually specifying `DOCKER_CERT_PATH=/home/user/.docker/` as well as `REQUESTS_CA_BUNDLE=/home/user/.docker/ca.pem`, individually and together.\r\n\r\nTo be clear: this setup works great with just docker daemon, but something about `-compose` is amiss."}}