Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to configure SSL host verification #192

Closed
rhuss opened this issue Jun 13, 2015 · 3 comments
Closed

Allow to configure SSL host verification #192

rhuss opened this issue Jun 13, 2015 · 3 comments
Labels
fixed
Milestone
0.13.0

Comments

@rhuss
Copy link
Collaborator

rhuss commented Jun 13, 2015

By default, the SSL host is verified when talking with the Docker host. This works fine except in situation when the docker host is contacted from within a run docker container by contacting it via the internal interface. That's because the docker host's server cert doesn't contain this internal IP.

SSLConnectionSocketFactory can be configured to use a ALLOW_ALLHOSTNAME_VERIFIER. This should be possible to switch on by env, prop, config.
@rhuss
Copy link
Collaborator Author

rhuss commented Jun 13, 2015

Raised an issue moby/moby#13922 since I believe, that Docker could do better here, too.

@rhuss
Copy link
Collaborator Author

rhuss commented Jun 13, 2015

Maybe as a simple fix evaluate DOCKER_TLS_VERIFY for deciding upon verification.

@rhuss rhuss added this to the 0.12.1 milestone Jun 15, 2015
@rhuss
Copy link
Collaborator Author

rhuss commented Jul 1, 2015

I will go the DOCKER_TLS_VERIFY route, since this is is the least intrusive solution for this quite special use case.

@rhuss rhuss added the fixed label Jul 1, 2015
@rhuss rhuss modified the milestones: 0.12.1, 0.13.0 Jul 3, 2015
@rhuss rhuss closed this as completed in 1afdad5 Jul 3, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
fixed
Projects
None yet
Milestone
0.13.0
Development

No branches or pull requests
1 participant
@rhuss