# Bad certs in single node docker installation **URL:** \ **Category:** SUSE Rancher Prime\ **Created:** [March 26, 2020, 5:34pm UTC](https://forums.suse.com/t/bad-certs-in-single-node-docker-installation/16940 "2020-03-26T17:34:48Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Austin-Earl](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/austin-earl/32/4916_2.png) [@Austin-Earl](https://forums.suse.com/u/Austin-Earl)\ **Post date:** [March 26, 2020, 5:34pm UTC](https://forums.suse.com/t/bad-certs-in-single-node-docker-installation/16940/1 "2020-03-26T17:34:48Z")
Hey So Our testing rancher instance just burned up… -\_- Im trying to figure out what happened Here are some details: Its a single node rancher installation through docker. We are useing self signed certs that rancher and kubernetes creates we have the server on 172.16.0.230 We are getting these errors when I do docker logs on rancher docker container > E0326 17:24:15.341812 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.StorageClass: Get [https://localhost:6443/apis/storage.k8s.io/v1/storageclasses?limit=500&resourceVersion=0:](https://localhost:6443/apis/storage.k8s.io/v1/storageclasses?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.341983 I | http: TLS handshake error from 127.0.0.1:60508: remote error: tls: bad certificate > E0326 17:24:15.342834 6 reflector.go:134] [k8s.io/kubernetes/cmd/kube-scheduler/app/server.go:178:](http://k8s.io/kubernetes/cmd/kube-scheduler/app/server.go:178:) Failed to list \*v1.Pod: Get [https://localhost:6443/api/v1/pods?fieldSelector=status.phase!%3DFailed%2Cstatus.phase!%3DSucceeded&limit=500&resourceVersion=0:](https://localhost:6443/api/v1/pods?fieldSelector=status.phase%21%3DFailed%2Cstatus.phase%21%3DSucceeded&limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.342887 I | http: TLS handshake error from 127.0.0.1:60510: remote error: tls: bad certificate > 2020-03-26 17:24:15.343833 I | http: TLS handshake error from 127.0.0.1:60512: remote error: tls: bad certificate > E0326 17:24:15.343885 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.PersistentVolume: Get [https://localhost:6443/api/v1/persistentvolumes?limit=500&resourceVersion=0:](https://localhost:6443/api/v1/persistentvolumes?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > E0326 17:24:15.350151 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.PersistentVolumeClaim: Get [https://localhost:6443/api/v1/persistentvolumeclaims?limit=500&resourceVersion=0:](https://localhost:6443/api/v1/persistentvolumeclaims?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.350252 I | http: TLS handshake error from 127.0.0.1:60514: remote error: tls: bad certificate > 2020-03-26 17:24:15.356600 I | http: TLS handshake error from 127.0.0.1:60516: remote error: tls: bad certificate > E0326 17:24:15.358639 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.Service: Get [https://localhost:6443/api/v1/services?limit=500&resourceVersion=0:](https://localhost:6443/api/v1/services?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > E0326 17:24:15.365366 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.StatefulSet: Get [https://localhost:6443/apis/apps/v1/statefulsets?limit=500&resourceVersion=0:](https://localhost:6443/apis/apps/v1/statefulsets?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.367842 I | http: TLS handshake error from 127.0.0.1:60518: remote error: tls: bad certificate > 2020-03-26 17:24:15.368033 I | http: TLS handshake error from 127.0.0.1:60520: remote error: tls: bad certificate > E0326 17:24:15.368080 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.ReplicaSet: Get [https://localhost:6443/apis/apps/v1/replicasets?limit=500&resourceVersion=0:](https://localhost:6443/apis/apps/v1/replicasets?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.374517 I | http: TLS handshake error from 127.0.0.1:60522: remote error: tls: bad certificate > E0326 17:24:15.374564 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1beta1.PodDisruptionBudget: Get [https://localhost:6443/apis/policy/v1beta1/poddisruptionbudgets?limit=500&resourceVersion=0:](https://localhost:6443/apis/policy/v1beta1/poddisruptionbudgets?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.376002 I | http: TLS handshake error from 127.0.0.1:60524: remote error: tls: bad certificate > E0326 17:24:15.376042 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.ReplicationController: Get [https://localhost:6443/api/v1/replicationcontrollers?limit=500&resourceVersion=0:](https://localhost:6443/api/v1/replicationcontrollers?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid > 2020-03-26 17:24:15.376960 I | http: TLS handshake error from 127.0.0.1:60526: remote error: tls: bad certificate > E0326 17:24:15.377020 6 reflector.go:134] [k8s.io/client-go/informers/factory.go:127:](http://k8s.io/client-go/informers/factory.go:127:) Failed to list \*v1.Node: Get [https://localhost:6443/api/v1/nodes?limit=500&resourceVersion=0:](https://localhost:6443/api/v1/nodes?limit=500&resourceVersion=0:) x509: certificate has expired or is not yet valid When Looking at the rancher agents I get this: > ERROR: [https://172.16.0.230:7443/ping](https://172.16.0.230:7443/ping) is not accessible (Failed to connect to 172.16.0.230 port 7443: Connection refused) > INFO: Arguments: --server [https://172.16.0.230:7443](https://172.16.0.230:7443) --token REDACTED --ca-checksum 6a2f0c412cdd4499b5ace7ac81407d616a197b7b1a6ee0ad5e8412140d8ccc62 --no-register --only-write-certs > INFO: Environment: CATTLE\_ADDRESS=172.16.0.230 CATTLE\_AGENT\_CONNECT=true CATTLE\_INTERNAL\_ADDRESS= CATTLE\_NODE\_NAME=BigThink CATTLE\_SERVER=[https://172.16.0.230:7443](https://172.16.0.230:7443) CATTLE\_TOKEN=REDACTED CATTLE\_WRITE\_CERT\_ONLY=true > INFO: Using resolv.conf: nameserver 172.16.0.1 > ERROR: [https://172.16.0.230:7443/ping](https://172.16.0.230:7443/ping) is not accessible (Failed to connect to 172.16.0.230 port 7443: Connection refused) Any ideas? I dont want to have to reinstall everything. Note: Yes I know a single node installation is a bad thing. I am current setting a multi node ha rancher cluster on one of our public servers. This was just to get us familar with the system, but we are currently relying on it for testing and dev. So I need to get it back up so others can continue to work on their projects (Or untill I configure everything to use the public servers). ---
**Author:** ![Austin-Earl](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/austin-earl/32/4916_2.png) [@Austin-Earl](https://forums.suse.com/u/Austin-Earl)\ **Post date:** [April 20, 2020, 6:29pm UTC](https://forums.suse.com/t/bad-certs-in-single-node-docker-installation/16940/2 "2020-04-20T18:29:50Z")
For future ref, I found the reason. When I installed rancher in the docker image I used the latest tag to it. Rancher updated and thus broke. Make sure you specify the version if you do single node install! ---
**Author:** ![Contadmin](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Contadmin](https://forums.suse.com/u/Contadmin)\ **Post date:** [May 26, 2020, 7:15am UTC](https://forums.suse.com/t/bad-certs-in-single-node-docker-installation/16940/3 "2020-05-26T07:15:48Z")
Any way to fix this without losing all data? ---
**Author:** ![mhoskiso](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/mhoskiso/32/6433_2.png) [@mhoskiso](https://forums.suse.com/u/mhoskiso)\ **Post date:** [June 2, 2020, 5:12pm UTC](https://forums.suse.com/t/bad-certs-in-single-node-docker-installation/16940/4 "2020-06-02T17:12:20Z")
Hi Contadmin, I also had a cert issue, not sure if it’s the same as OP but I resolved it by installing certbot on the node and launching Rancher with the --no-cacerts option and the certificates mounted from the nodes. I had no data loss when taking cert issuance out of Rancher. You may need to relaunch Rancher at some point for it to pickup the new certificate. docker run -d --restart=unless-stopped -p 80:80 -p 443:443 -v /root/rancher:/var/lib/rancher -v /etc/letsencrypt/live/removed/fullchain.pem:/etc/rancher/ssl/cert.pem -v /etc/letsencrypt/live/removed/privkey.pem:/etc/rancher/ssl/key.pem rancher/rancher:latest –no-cacerts