home/harbor
2
0
Fork 0
mirror of https://github.com/wahyd4/harbor.git synced 2026-08-15 07:46:05 +10:00
Code Issues Packages Projects Releases Wiki Activity

update documents

Browse Source
This commit is contained in:
Henry Zhang
2016-03-31 11:27:22 +08:00
parent 3ebb2dea0f
commit 07a9003ded
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configure_https.md
+7 -7
View File
@@ -4,7 +4,7 @@ Because Harbor does not ship with any certificates, it uses HTTP by default to s
##Get a certificate
Assuming that your registry’s **hostname** is **reg.yourdomain.com**, and that its DNS record points to the host where you are running Harbor, you first should get a certificate from a CA. The certificate usually contains a .crt file and a .key file, for example, **yourdomain.com.crt** and **yourdomain.com.key**.
Assuming that your registry’s **hostname** is **reg.yourdomain.com**, and that its DNS record points to the host where you are running Harbor. You first should get a certificate from a CA. The certificate usually contains a .crt file and a .key file, for example, **yourdomain.com.crt** and **yourdomain.com.key**.
In a test or development environment, you may choose to use a self-signed certificate instead of the one from a CA. The below commands generate your own certificate:
@@ -20,9 +20,9 @@ In a test or development environment, you may choose to use a self-signed certif
-newkey rsa:4096 -nodes -sha256 -keyout yourdomain.com.key \
-out yourdomain.com.csr
```
3) Generate the certificate of your registry host
3) Generate the certificate of your registry host:
You need to configure openssl first. On Ubuntu, the config file locates at /etc/ssl/openssl.cnf. Refer to openssl document for more information. The default CA directory of openssl is called demoCA. Let’s creates necessary directories and files:
You need to configure openssl first. On Ubuntu, the config file locates at /etc/ssl/openssl.cnf. Refer to openssl document for more information. The default CA directory of openssl is called demoCA. Let’s create necessary directories and files:
```
mkdir demoCA
cd demoCA
@@ -32,7 +32,7 @@ You need to configure openssl first. On Ubuntu, the config file locates at /etc/
```
Then run this command to generate the certificate of your registry host:
```
openssl ca -in yourdomain.com.csr -out yourdomain.com.crt -cert ca.crt -keyfile ca.key –outdir .
openssl ca -in yourdomain.com.csr -out yourdomain.com.crt -cert ca.crt -keyfile ca.key -outdir .
```
##Configuration of Nginx
@@ -50,7 +50,7 @@ Copy the template **nginx.https.conf** as the new configuration file:
```
cp nginx.https.conf nginx.conf
```
Edit the file nginx.conf and replace two occurrences of **server name** harbordomain.com to your own host name: reg.yourdomain.com .
Edit the file nginx.conf and replace two occurrences of **harbordomain.com** to your own host name, such as reg.yourdomain.com .
```
server {
listen 443 ssl;
@@ -106,11 +106,11 @@ After setting up HTTPS for Harbor, you can verify it by the follow steps:
docker login reg.yourdomain.com
```
##Troubleshooting
1.` `You may get an intermediate certificate from a certificate issuer. In this case, you should merge the intermediate certificate with your own certificate to create a certificate bundle. You can achieve this by the below command:
1. You may get an intermediate certificate from a certificate issuer. In this case, you should merge the intermediate certificate with your own certificate to create a certificate bundle. You can achieve this by the below command:
```
cat intermediate-certificate.pem >> yourdomain.com.crt
```
2.` `On some systems where docker daemon runs, you may need to trust the certificate at OS level.
2. On some systems where docker daemon runs, you may need to trust the certificate at OS level.
On Ubuntu, this can be done by below commands:
```
cp youdomain.com.crt /usr/local/share/ca-certificates/reg.yourdomain.com.crt