# Problem with SSL by trying to add a host

**URL:** <https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536>\
**Category:** Rancher 1.x\
**Created:** [April 20, 2016, 5:26pm UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536 "2016-04-20T17:26:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Flo\_B](https://avatars.discourse-cdn.com/v4/letter/f/f1d935/32.png) [@Flo\_B](https://forums.suse.com/u/Flo_B)\
**Post date:** [April 20, 2016, 5:26pm UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/1 "2016-04-20T17:26:46Z")

</div>

Continuing the discussion from [GeoTrust Global CA not supported?](http://forums.suse.com/t/geotrust-global-ca-not-supported/2260/2):

Hey Vincent,

i had the same problem like JD\_Trout, i also have forgotten to add the intermediate CA… i did this and also tested this one:

> docker run --entrypoint openssl rancher/agent:v0.11.0 s\_client -CApath /etc/ssl/certs/ -connect www.study1.eu:443 | grep local  
> depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority  
> verify return:1  
> depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA  
> verify return:1  
> depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA - G3  
> verify return:1  
> depth=0 CN = www.study1.eu  
> verify return:1  
> DONE

But now i’m getting this error when i try to add a host:

> INFO: [https://www.study1.eu/v1](https://www.study1.eu/v1) is accessible  
> Traceback (most recent call last):  
> File “./resolve\_url.py”, line 9, in   
> r = requests.get(url)  
> File “/usr/local/lib/python2.7/site-packages/requests/api.py”, line 67, in get  
> return request(‘get’, url, params=params, \*\*kwargs)  
> File “/usr/local/lib/python2.7/site-packages/requests/api.py”, line 53, in request  
> return session.request(method=method, url=url, \*\*kwargs)  
> File “/usr/local/lib/python2.7/site-packages/requests/sessions.py”, line 468, in request  
> resp = self.send(prep, \*\*send\_kwargs)  
> File “/usr/local/lib/python2.7/site-packages/requests/sessions.py”, line 576, in send  
> r = adapter.send(request, \*\*kwargs)  
> File “/usr/local/lib/python2.7/site-packages/requests/adapters.py”, line 447, in send  
> raise SSLError(e, request=request)  
> requests.exceptions.SSLError: (“bad handshake: Error([(‘SSL routines’, ‘SSL3\_GET\_SERVER\_CERTIFICATE’, ‘certificate verify failed’)],)”,)  
> curl: no URL specified!  
> curl: try ‘curl --help’ or ‘curl --manual’ for more information  
> ERROR: returned  
> ERROR: — START —  
> ERROR: — END —

> ERROR: Failed to load registration env from CATTLE\_URL=[https://www.study1.eu/v1](https://www.study1.eu/v1) ENV\_URL=  
> ERROR: Please ensure the proper value for the Host Registration URL is set

Still seems so, that i misconfigured somethink with the certificates, but this time i’m getting one step further…

Any Ideas for the last step? 🙂

Regards,  
Florian

---

<div class="post-metadata">

**Author:** ![denise](https://avatars.discourse-cdn.com/v4/letter/d/82dd89/32.png) [@denise](https://forums.suse.com/u/denise)\
**Post date:** [May 6, 2016, 6:24am UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/2 "2016-05-06T06:24:21Z")

</div>

It seems like you’re missing part of the command in the docker run command.

Would you be able to share the command that you used to start rancher/agent?

---

<div class="post-metadata">

**Author:** ![Flo\_B](https://avatars.discourse-cdn.com/v4/letter/f/f1d935/32.png) [@Flo\_B](https://forums.suse.com/u/Flo_B)\
**Post date:** [May 9, 2016, 5:06pm UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/3 "2016-05-09T17:06:00Z")

</div>

sudo docker run -d --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v0.11.0 [https://www.study1.eu/v1/scripts/](https://www.study1.eu/v1/scripts/)

In the directory /var/lib/rancher/etc/ssl i stored alle certificates in one file…

GeoTrust Global CA / RapidSSL SHA256 CA - G3 / [www.study1.eu](http://www.study1.eu)

---

<div class="post-metadata">

**Author:** ![denise](https://avatars.discourse-cdn.com/v4/letter/d/82dd89/32.png) [@denise](https://forums.suse.com/u/denise)\
**Post date:** [May 17, 2016, 3:02am UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/4 "2016-05-17T03:02:37Z")

</div>

Typically a docker run command will be more like

```auto
sudo docker run -d --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.0.1 http://<serverURL>:8080/v1/scripts/<token_to_environment>

```

You’re missing the `<token_to_environment>` section of the command.

---

<div class="post-metadata">

**Author:** ![Flo\_B](https://avatars.discourse-cdn.com/v4/letter/f/f1d935/32.png) [@Flo\_B](https://forums.suse.com/u/Flo_B)\
**Post date:** [May 18, 2016, 9:22am UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/5 "2016-05-18T09:22:47Z")

</div>

My Rancher UI say i should run this command on a Host:

sudo docker run -d --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v0.11.0 [https://www.study1.eu/v1/scripts/AA1DEB8D7EA51C985:1463562000000:VMdjRSSh6Ol8BezwWe6WP3](https://www.study1.eu/v1/scripts/AA1DEB8D7EA51C985:1463562000000:VMdjRSSh6Ol8BezwWe6WP3)  
(i removed some token content…)  
Rancher v1.0.0  
Cattle v0.159.2  
User Interface v0.100.3  
Rancher Compose v0.7.3

I noticed that your command uses Agent Version **v1.0.1** and my one uses **v0.11.0** , which rancher version you are using?

---

<div class="post-metadata">

**Author:** ![denise](https://avatars.discourse-cdn.com/v4/letter/d/82dd89/32.png) [@denise](https://forums.suse.com/u/denise)\
**Post date:** [May 19, 2016, 5:47am UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/6 "2016-05-19T05:47:26Z")

</div>

The UI will always provide the correct rancher/agent version to be launched. I was using either v1.0.1 or v1.1.0-dev2-rc3 to get my example, which is using rancher/agent v1.0.1.

If you are running v1.0.0, then you should use rancher/agent:v0.11.0.

---

<div class="post-metadata">

**Author:** ![cclairmont](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@cclairmont](https://forums.suse.com/u/cclairmont)\
**Post date:** [August 25, 2016, 3:57pm UTC](https://forums.suse.com/t/problem-with-ssl-by-trying-to-add-a-host/2536/7 "2016-08-25T15:57:00Z")

</div>

Hi All,

I use Let’s Encrypt to generate and manage our SSL certificates. We installed our Rancher in HA mode, and now it works fine. But it was impossible for us to add a host !

Terrible !

As describe in this post we met some certificat validation error.

The logs of the rancher/agent:v1.0.2 instance here:

`  
Updating certificates in /etc/ssl/certs… 1 added, 0 removed; done.  
Running hooks in /etc/ca-certificates/update.d…done.

INFO: Running Agent Registration Process, CATTLE\_URL=https://\<\>.\<\>.\<\>/v1  
INFO: Checking for Docker version \>= 1.6.0  
INFO: Found Server version: 1.10.3  
INFO: docker version: Client version: 1.6.0  
INFO: docker version: Client API version: 1.18  
INFO: docker version: Go version (client): go1.4.2  
INFO: docker version: Git commit (client): 4749651  
INFO: docker version: OS/Arch (client): linux/amd64  
INFO: docker version: Server version: 1.10.3  
INFO: docker version: Server API version: 1.22  
INFO: docker version: Go version (server): go1.5.4  
INFO: docker version: Git commit (server): 3cd164c  
INFO: docker version: OS/Arch (server): linux/amd64  
INFO: docker info: Containers: 1  
INFO: docker info: Images: 30  
INFO: docker info: Storage Driver: overlay  
INFO: docker info: Backing Filesystem: extfs  
INFO: docker info: Execution Driver: native-0.2  
INFO: docker info: Kernel Version: 4.6.3-coreos  
INFO: docker info: Operating System: CoreOS 1068.10.0 (MoreOS)  
INFO: docker info: CPUs: 2  
INFO: docker info: Total Memory: 7.616 GiB  
INFO: docker info: Name: rancher011  
INFO: docker info: ID: 5LGQ:QP74:ALX4:ZLHW:LSSH:ADLC:I2HX:PLWN:6UUD:CL54:Y6U4:NHW2  
INFO: docker info: Http Proxy:  
INFO: docker info: Https Proxy:  
INFO: docker info: No Proxy:  
INFO: Attempting to connect to: https://\<\>.\<\>.\<\>/v1  
INFO: https://\<\>.\<\>.\<\>/v1 is accessible  
Traceback (most recent call last):  
File “./resolve\_url.py”, line 9, in   
r = requests.get(url)  
File “/usr/local/lib/python2.7/site-packages/requests/api.py”, line 67, in get  
return request(‘get’, url, params=params, \*\*kwargs)  
File “/usr/local/lib/python2.7/site-packages/requests/api.py”, line 53, in request  
return session.request(method=method, url=url, \*\*kwargs)  
File “/usr/local/lib/python2.7/site-packages/requests/sessions.py”, line 468, in request  
resp = self.send(prep, \*\*send\_kwargs)  
File “/usr/local/lib/python2.7/site-packages/requests/sessions.py”, line 576, in send  
r = adapter.send(request, \*\*kwargs)  
File “/usr/local/lib/python2.7/site-packages/requests/adapters.py”, line 447, in send  
raise SSLError(e, request=request)  
requests.exceptions.SSLError: (“bad handshake: Error([(‘SSL routines’, ‘SSL3\_GET\_SERVER\_CERTIFICATE’, ‘certificate verify failed’)],)”,)  
curl: no URL specified!  
curl: try ‘curl --help’ or ‘curl --manual’ for more information  
ERROR: returned  
ERROR: — START —  
ERROR: — END —

ERROR: Failed to load registration env from CATTLE\_URL=https://\<\>.\<\>.\<\>/v1 ENV\_URL=  
ERROR: Please ensure the proper value for the Host Registration URL is set  
`

So as you can see we faced an exception "**requests.exceptions.SSLError: ("bad handshake: Error([(‘SSL routines’, ‘SSL3\_GET\_SERVER\_CERTIFICATE’,**"

In the Rancher Agent project ([https://github.com/rancher/rancher/tree/master/agent](https://github.com/rancher/rancher/tree/master/agent)) we modify the **[run.sh](http://run.sh)**

git diff of the modification we make (after so many tests)

* * *

## `diff --git a/agent/run.sh b/agent/run.sh index 156a8fb..1e582d1 100755 --- a/agent/run.sh +++ b/agent/run.sh @@ -63,7 +63,8 @@ print_url() setup_custom_ca_bundle() { check_and_add_conf "CURL_CA_BUNDLE" ${CA_CERT_FILE} - check_and_add_conf "REQUESTS_CA_BUNDLE" ${CA_CERT_FILE} +# check_and_add_conf "REQUESTS_CA_BUNDLE" ${CA_CERT_FILE} + check_and_add_conf "REQUESTS_CA_BUNDLE" "/etc/ssl/certs/ca-certificates.crt" # Update core container CA certs for Golang mkdir -p /usr/local/share/ca-certificates/rancher`

We spent so many time on this error ! We finally resolved by replacing the ${CA\_CERT\_FILE} by the openssl file that contains all certificates (and ours too): /etc/ssl/certs/ca-certificates.crt.

For Let’s Encrypt certificates, it works for us. I suppose, it’s a bug of Rancher Agent. We did not tested with other certificate provider.

Could other folks confime if this patch works for them too ?

Cheers