Generate TLS on boot

[AkihiroSuda]

The dind daemon entrypoint script should support generating TLS keys for the daemon and the clients, and set appropriate dockerd flags when an environment variable like DIND_TLS_SAN is specified.

e.g.

$ docker run -d --privileged --name some-docker -e DIND_TLS_SAN=DNS:docker,DNS:localhost docker:dind
$ docker cp some-docker:/certs/for-client ./certs-for-client
$ docker run --rm --link some-docker:docker -v $(pwd)/certs-for-client:/root/.docker -e DOCKER_HOST=tcp://docker:2376 docker info

[tianon]

Is SubjectAltName actually required here? (Does Docker verify it?)

[AkihiroSuda]

We could use CN instead but SubjectAltName is better for supporting multiple names

[tianon]

That kind of makes sense, but I don't get why Docker needs SAN at all given that there's both a client cert and a server cert signed by the same CA for verifying both directions. Isn't a SAN overkill in this case?

[AkihiroSuda]

Seems SANS are mandatory in Docker 19.03

$ docker info
...
Server:
ERROR: error during connect: Get https://127.0.0.1:2376/v1.24/info: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

$ openssl x509 -text -in server-cert.pem  -noout
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            1d:83:5c:78:b3:5f:19:e8:8e:ea:fe:00:3d:3b:bf:94:30:4d:b1:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Validity
            Not Before: Jul 11 03:02:31 2019 GMT
            Not After : Jul 10 03:02:31 2020 GMT
        Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:bf:ee:a4:58:d4:69:fc:fd:71:19:1e:aa:64:cf:
...
                    b6:93:37
                Exponent: 65537 (0x10001)
  Signature Algorithm: sha256WithRSAEncryption
        44:83:6e:1b:f9:ab:9d:09:ff:b1:e4:3a:00:0e:13:ba:d1:5e:
...
         29:58:aa:56:40:04:af:60

[AkihiroSuda]

@justincormack @cyphar

Do you think we can allow certs without CA/SANs?

[justincormack]

SANs are pretty much mandatory now generally, eg Chrome won't accept certs without them, and CN is deprecated.