Docker-Examples icon indicating copy to clipboard operation
Docker-Examples copied to clipboard

fix docker build issues and enhance compatibility

Open feifangit opened this issue 9 years ago • 0 comments

  1. specify ubuntu:14.04 and remove ssl_crl to make docker build work
  2. use different serial number to generate client.crt. on CentOS 7, I have curl version detail
curl -V
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.19.1 Basic ECC zlib/1.2.7 libidn/1.28 libssh2/1.4.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz

and this is the curl version detail on Ubuntu

curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP UnixSockets

the major difference is the SSL library, one is NSS while another is GnuTLS

when I send request to the nginx-container, it pops up error due to a more restricted check. see link:

  • http://www-archive.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html
  • https://curl.haxx.se/docs/ssl-compared.html
curl -vvv  --insecure --key ./client.key --cert ./client.crt https://localhost:32774
* About to connect() to localhost port 32774 (#0)
*   Trying ::1...
* Connected to localhost (::1) port 32774 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -8054 (SEC_ERROR_REUSED_ISSUER_AND_SERIAL)
* You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.
* Closing connection 0
curl: (35) You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.

feifangit avatar Jul 18 '16 20:07 feifangit