Cert issue with cloudflare when pulling images

claytontstevenson commented 3 months ago

A bit of an issue came up with the Vagrant quickstart option here. For background this was working correctly until some recent cloudflare maintenance. I noticed this issue beginning last week.

When running the command to start up the vagrant boxes it starts working correctly until the attempt at pulling images, at which point there is a cert error as seen here:

    server-01: + for image in $curlimage $jqimage "rancher/rancher:${rancher_version}"
    server-01: + docker inspect appropriate/curl
    server-01: + docker pull appropriate/curl
    server-01: Using default tag: latest
    server-01: latest: Pulling from appropriate/curl
    server-01: ff3a5c916c92: Pulling fs layer
    server-01: 3151abf94102: Pulling fs layer
    server-01: 58ae3cb4aac4: Pulling fs layer
    server-01: error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/d3/d37e1f717dc01df3a838955d29a149c569352c0991b1d7cf11b4ebca8c6c7f55/data?verify=1713529598-3jnBGyH9b626%2F1MRY0zJYJAd8Ng%3D: x509: certificate has expired or is not yet valid
    server-01: + sleep 2
    server-01: + docker inspect appropriate/curl

I checked the time on the VM to make sure and it seemed to be correct. Pulling these images on my local machine which is running virtualbox results in no error which is why this appears to be something in the vm.

I'm happy to provide any additional logs or information here

robertsirc commented 2 months ago

Can you link the quick start guide? I know there are a few out there and I want to make sure it is up-to-date

claytontstevenson commented 2 months ago

This is the one I was following: https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/vagrant

Which this is more or less the same instructions as in the readme for the repo https://github.com/rancher/quickstart/tree/master/rancher/vagrant

orsi-dev commented 2 months ago

i m facing the same issue for days and i've found a workaround for that. You should set the daemon.json ( /etc/docker/daemon.json on rancherOs ) docker file with a registry mirror like that:

{ "registry-mirrors": ["https://registry.hub.docker.com/"] }

vonBork commented 1 month ago

The certificate of cloudflare is fine. I checked it via openssl.

openssl s_client -connect production.cloudflare.docker.com:443 | openssl x509 -dates -noout
Warning: Reading certificate from stdin since no -in or -new option is given
Connecting to 104.16.98.215
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X2
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=E1
verify return:1
depth=0 CN=production.cloudflare.docker.com
verify return:1
notBefore=Apr 10 23:38:51 2024 GMT
notAfter=Jul  9 23:38:50 2024 GMT

I guess the certificates of the base image might got old. It might helps updating the base Image.

rancher / quickstart

Cert issue with cloudflare when pulling images #234