GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Add additional extensions to generated ssl certs by jnoordsij · Pull Request #536 · docker-library/docker

Conversation

jnoordsij commented May 19, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

This MR adds some additional extensions to the self-generated CA and server certificates the dind image may employ to set up TLS connections. This ensures the certificates (better) match RFCs specifying these extensions as required (see https://datatracker.ietf.org/doc/html/rfc3280 and https://datatracker.ietf.org/doc/html/rfc5280). This is particularly relevant for clients enforcing checks on this while connecting.

Source of the problem

When using my combination of:

GitLab CI
Docker dind image as service in CI job
Python Docker image employing the Docker SDK for Python to connect to the Docker daemon

I was presented with errors among the following lines:

docker.errors.DockerException: Error while fetching server API version: HTTPSConnectionPool(host='docker', port=2376): Max retries exceeded with url: /version (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: CA cert does not include key usage extension (_ssl.c:1028)')))

This is due to a recent change in the Python urllib3 package used by the Python Docker SDK, which follows the stricter checks Python introduced with >=3.13.

MWE + proof of fix

I've created https://gitlab.com/jnoordsij/test-docker-ci/-/tree/e5289dcdc5a736663d66ea4199f95f5c94d73fec as basic example of attempting to use the Python Docker SDK with the dind image that fails; see https://gitlab.com/jnoordsij/test-docker-ci/-/jobs/10076832026.

After building a patched dind image (https://gitlab.com/jnoordsij/test-docker-ci/-/commit/0c6a1ac70fd6d6f26e29af8d5d797b3d70d41967) and using that in the CI job, everything seems to work fine
(see also https://gitlab.com/jnoordsij/test-docker-ci/-/pipelines/1824971402).

Further notes

I think technically speaking only the second commit, updating the CA cert, is required to fix this particular issue. However when looking into this, I figured adding the server cert extensions is probably good practice, especially with this being recommended in official documentation.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

jnoordsij added 2 commits

May 19, 2025 15:10


          Add extendedKeyUsage = serverAuth to dind generated server cert

b5332f2

Matches upstream documentation recommendations on https://docs.docker.com/engine/security/protect-access/#use-tls-https-to-protect-the-docker-daemon-socket


          Add keyUsage extension to dind generated CA cert

52c8bfa

Required for compliance with X.509 RFCs

tianon approved these changes

May 19, 2025

View reviewed changes

tianon left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oof, thank you ❤️

This is 100% neither your fault nor your problem, but even as the original author of most of this code, I hate it - I hate that we have to have it, I hate how complicated it is, and I especially hate that it's so fiddly to get "right"

I would love to deprecate it all, tell everyone to use the Unix socket instead, and call it a day, but that's not terribly realistic. 😞

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

tianon reviewed

May 19, 2025

View reviewed changes

Comment thread

dockerd-entrypoint.sh

		-subj '/CN=docker:dind CA' \
		-x509 \
		-days "$certValidDays" \
		-addext keyUsage=critical,digitalSignature,keyCertSign

tianon May 19, 2025

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All the OpenSSL docs say about critical here is this:

If critical is present then the extension will be marked as critical.

Do you have a reference for why this is necessary? 🤔

The docs also suggest this can be more whitespace-y, so if we need to touch this again I think I might try something like this:

Suggested change

	-addext keyUsage=critical,digitalSignature,keyCertSign
	-addext 'keyUsage = critical, digitalSignature, keyCertSign'

But we should probably add a new test or update our existing test to make sure this stays working before we touch it again (since you've done good validation on this change as-is). ❤️

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

jnoordsij reacted with thumbs up emoji

All reactions

👍 1 reaction

jnoordsij May 20, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the RFC section 4.2.1.3 Key Usage:

This extension MUST appear in certificates that contain public keys
that are used to validate digital signatures on other public key
certificates or CRLs. When this extension appears, it SHOULD be
marked critical.

Edit: also definitely not an expert on this in any way, mostly looked for fixes I found elsewhere with people encountering the same type of issue when using Python 3.13 combined with some server application employing self-signed certificates.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

tianon reacted with thumbs up emoji

tianon reacted with heart emoji

All reactions

👍 1 reaction
❤️ 1 reaction

tianon merged commit 8979f92 into docker-library:master

May 19, 2025

docker-library-bot added a commit to docker-library-bot/official-images that referenced this pull request

May 19, 2025


          Update docker

a4c893c

Changes:

- docker-library/docker@861512c: Update 28-rc
- docker-library/docker@8979f92: Merge pull request docker-library/docker#536 from jnoordsij/add-ssl-ext
- docker-library/docker@8daf440: Update 28-rc to 28.2.0-rc.1, buildx 0.23.0, compose 2.36.1
- docker-library/docker@d370b5c: Update 28 to compose 2.36.1
- docker-library/docker@52c8bfa: Add keyUsage extension to dind generated CA cert
- docker-library/docker@b5332f2: Add extendedKeyUsage = serverAuth to dind generated server cert

tianon mentioned this pull request

May 19, 2025

Update docker docker-library/official-images#19058

Merged

jnoordsij deleted the add-ssl-ext branch

May 20, 2025 07:20

jnoordsij commented May 20, 2025

Copy link

Copy Markdown

Contributor Author

Oof, thank you ❤️

This is 100% neither your fault nor your problem, but even as the original author of most of this code, I hate it - I hate that we have to have it, I hate how complicated it is, and I especially hate that it's so fiddly to get "right"

I would love to deprecate it all, tell everyone to use the Unix socket instead, and call it a day, but that's not terribly realistic. 😞

Yeah I understand your feelings on this, it feels a bit too over-complicated to have this here. Deprecating it will probably be quite a hard thing to achieve. However, at least it does what it have to do right now pretty good, and I think generally it should be more or less a stable approach apart from cases like this enforcing a bit more strictness.

For changing towards sockets, just looking at GitLab for example, they do list using a socket as an option in their docs, but not as the preferred one (section starts with "You should use Docker-in-Docker with TLS enabled, which is supported by GitLab.com instance runners.") and moreover one that thus does not seem to be supported by their shared instance runners.

Although I could not find current shared runner configuration in their current docs, an older version only had a mount bind configured for the TLS based setup.

So before any of this could happen that would probably require quite a bit of effort in getting them to migrate, and then there's probably still lots of other usecases for the TLS approach out there 😓

tianon and yosifkit reacted with thumbs up emoji

tianon and yosifkit reacted with heart emoji

All reactions

👍 2 reactions
❤️ 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gquintard pushed a commit to gquintard/official-images that referenced this pull request

Jun 11, 2025


          Update docker

20db348

Changes:

- docker-library/docker@861512c: Update 28-rc
- docker-library/docker@8979f92: Merge pull request docker-library/docker#536 from jnoordsij/add-ssl-ext
- docker-library/docker@8daf440: Update 28-rc to 28.2.0-rc.1, buildx 0.23.0, compose 2.36.1
- docker-library/docker@d370b5c: Update 28 to compose 2.36.1
- docker-library/docker@52c8bfa: Add keyUsage extension to dind generated CA cert
- docker-library/docker@b5332f2: Add extendedKeyUsage = serverAuth to dind generated server cert

tglman pushed a commit to tglman/official-images that referenced this pull request

Aug 11, 2025


          Update docker

ff42559

Changes:

- docker-library/docker@861512c: Update 28-rc
- docker-library/docker@8979f92: Merge pull request docker-library/docker#536 from jnoordsij/add-ssl-ext
- docker-library/docker@8daf440: Update 28-rc to 28.2.0-rc.1, buildx 0.23.0, compose 2.36.1
- docker-library/docker@d370b5c: Update 28 to compose 2.36.1
- docker-library/docker@52c8bfa: Add keyUsage extension to dind generated CA cert
- docker-library/docker@b5332f2: Add extendedKeyUsage = serverAuth to dind generated server cert

gquintard pushed a commit to gquintard/official-images that referenced this pull request

Aug 15, 2025


          Update docker

14dd398

Changes:

- docker-library/docker@861512c: Update 28-rc
- docker-library/docker@8979f92: Merge pull request docker-library/docker#536 from jnoordsij/add-ssl-ext
- docker-library/docker@8daf440: Update 28-rc to 28.2.0-rc.1, buildx 0.23.0, compose 2.36.1
- docker-library/docker@d370b5c: Update 28 to compose 2.36.1
- docker-library/docker@52c8bfa: Add keyUsage extension to dind generated CA cert
- docker-library/docker@b5332f2: Add extendedKeyUsage = serverAuth to dind generated server cert

junojense pushed a commit to DDVTECH/docker-image-library that referenced this pull request

Dec 3, 2025


          Update docker

728d732

Changes:

- docker-library/docker@861512c: Update 28-rc
- docker-library/docker@8979f92: Merge pull request docker-library/docker#536 from jnoordsij/add-ssl-ext
- docker-library/docker@8daf440: Update 28-rc to 28.2.0-rc.1, buildx 0.23.0, compose 2.36.1
- docker-library/docker@d370b5c: Update 28 to compose 2.36.1
- docker-library/docker@52c8bfa: Add keyUsage extension to dind generated CA cert
- docker-library/docker@b5332f2: Add extendedKeyUsage = serverAuth to dind generated server cert

Reviewers

tianon

tianon approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

jnoordsij commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Source of the problem

MWE + proof of fix

Further notes

Uh oh!

tianon left a comment

Choose a reason for hiding this comment

Uh oh!

tianon May 19, 2025

Choose a reason for hiding this comment

Uh oh!

jnoordsij May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jnoordsij commented May 20, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jnoordsij commented May 19, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

jnoordsij May 20, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.