2

I have a Dockerfile inside which I run npm install

... RUN npm install ....

This errors out with the following:

npm ERR! Linux 4.4.0-92-generic
npm ERR! argv "/usr/local/bin/node" "/usr/local/bin/npm" "install"
npm ERR! node v7.10.1
npm ERR! npm  v4.2.0
npm ERR! code DEPTH_ZERO_SELF_SIGNED_CERT
npm ERR! self signed certificate

I don't hit this issue when running npm install directly on the same machine. (i.e when I am running it not part of docker build). So I don't believe the issue is related to any http proxies.

@Tarun,

Here is the output of curl -v https://docker.com

----* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256

  • server certificate verification OK

  • server certificate status verification SKIPPED

  • common name: *.docker.com (matched)

  • server certificate expiration date OK

  • server certificate activation date OK

  • certificate public key: RSA

  • certificate version: #3

  • subject: CN=*.docker.com

  • start date: Fri, 11 Aug 2017 00:00:00 GMT

  • expire date: Tue, 11 Sep 2018 12:00:00 GMT

  • issuer: C=US,O=Amazon,OU=Server CA 1B,CN=Amazon

  • compression: NULL

  • ALPN, server did not agree to a protocol

GET / HTTP/1.1

Host: docker.com

User-Agent: curl/7.47.0

And here is the curl command from inside a docker container on the box.

root@2145cd2e9997:/app/c3po# curl -v https://docker.com

  • Rebuilt URL to: https://docker.com/

  • Hostname was NOT found in DNS cache

  • Trying 52.55.168.191...

  • Connected to docker.com (52.55.168.191) port 443 (#0)

  • successfully set certificate verify locations:

  • CAfile: none

    CApath: /etc/ssl/certs

  • SSLv3, TLS handshake, Client hello (1):

  • SSLv3, TLS handshake, Server hello (2):

  • SSLv3, TLS handshake, CERT (11):

  • SSLv3, TLS alert, Server hello (2):

  • SSL certificate problem: self signed certificate

  • Closing connection 0

  • SSLv3, TLS alert, Client hello (1):

curl: (60) SSL certificate problem: self signed certificate

More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.

If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).

If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.

boboverflow
  • 309
  • 4
  • 10
  • what is the output of `env` on your machine? Please updated the output in question. Also output of `curl -v https://docker.com` – Tarun Lalwani Sep 14 '17 at 16:52
  • @TarunLalwani thanks for your response.I have updated the question with output of curl -v https://docker.com – boboverflow Sep 14 '17 at 17:43
  • @TarunLalwani, what env variables are you looking for. – boboverflow Sep 14 '17 at 17:49
  • Can you check the same `curl -v https://docker.com` inside the container also? Probably some issue with SSL inside container – Tarun Lalwani Sep 14 '17 at 17:53
  • ha, looks like networking inside my container is completely broken. I could not do 'RUN apt-get update && apt-get install curl' when running docker build. I see these errors ------ Err http://archive.ubuntu.com trusty-backports/multiverse amd64 Packages Connection failed [IP: 91.189.88.152 80] W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/trusty/Release.gpg Connection failed [IP: 91.189.88.152 80] ------ – boboverflow Sep 14 '17 at 18:11
  • Added the curl command output from inside the docker container. Thanks. – boboverflow Sep 14 '17 at 18:48

2 Answers2

2

If you are running a few npm commands from Dockerfile, then you can add this before you run the npm commands:

RUN npm config set strict-ssl false
RUN npm install

Note: it is recommended to copy your company's root certificates (if you are behind a company firewall) to the container rather than disabling SSL altogether.

Rahul Bharadwaj
  • 2,555
  • 2
  • 18
  • 29
0

I figured this out. I was running jenkins on the docker host, and I was using iptables to forward port 443 to 8080. This was conflicting with docker's own iptable rules which was causing all my issues with self signed certs.

This stackoverflow post helped me identify the issue: SSL certificate verification fails inside docker container on specific server

boboverflow
  • 309
  • 4
  • 10