<div dir="ltr">Yes, you are a step further now that TLS is spoken. However, I would suggest to first get your test working locally on the lxd server, since my homebrew OSX curl has further restrictions. You can only use certificates that are in the keychain:<div><div>* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.</div><div>* WARNING: SSL: Certificate type not set, assuming PKCS#12 format.</div></div><div><br></div><div>When trying your example on my lxd server, I do the following steps (as root user).</div><div><br></div><div># cd /root/.config/lxc</div><div># ls</div><div>client.crt client.key config.yml servercerts<br></div><div><br></div><div>Now, if you don't have these files, use can get them by doing the following:</div><div># lxc remote add lxc-org <a href="http://images.linuxcontainers.org">images.linuxcontainers.org</a><br></div><div><br></div><div>This should also initialise the local client certificate if it does not exist.</div><div><br></div><div>Then:</div><div># lxc config trust add client.crt</div><div># lxc config trust list</div><div>This should list the fingerprint.</div><div><br></div><div>And it should work:</div><div># curl --key client.key --cert client.crt -v -k <a href="https://localhost:8443/1.0/images">https://localhost:8443/1.0/images</a></div><div><br></div><div>(do not use the -s option as it will suppress the output)</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-05-23 7:53 GMT+02:00 Kevin LaTona <span dir="ltr"><<a href="mailto:lists@studiosola.com" target="_blank">lists@studiosola.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><span class=""><br><div><div>On May 22, 2015, at 10:33 PM, Kevin LaTona <<a href="mailto:lists@studiosola.com" target="_blank">lists@studiosola.com</a>> wrote:</div><br><blockquote type="cite"><blockquote type="cite" style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><p dir="ltr">Ok, but you are testing with a curl that does not support TLS. That is why you cannot connect to that particular LXD instance. Depending on the OS and distribution, other LXD instances may still support SSL.</p><div><br></div></blockquote></blockquote><br></div><div><br></div><div><br></div><div><br></div></span><div>I did a quick upgrade of curl to 7.42.1</div><div><br></div><div>Now when I try it </div><div><br></div><div>/usr/local/Cellar/curl/7.42.1/bin/curl -s --cert server.crt --key server.key -k <a href="https://192.168.0.50:8443/1.0/images" target="_blank">https://192.168.0.50:8443/1.0/images</a></div><div><br></div><div>I know I don't want to mess with Apple's install of Curl for now.</div><div><br></div><div><br></div><div>I get ………… curl: (35) SSL peer handshake failed, the server most likely requires a client certificate to connect</div><div><br></div><div>So maybe I am getting closer and some thing is off with the cert I just made.</div><div><br></div><div><br></div><div>Would be nice to know what version of LDX is running at <a href="http://linuxcontainers.org" target="_blank">linuxcontainers.org</a> </div><div><br></div><div>It sure might help saving lots of time chasing after another avenue that in the end may or may not solve problem.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>-Kevin</div></font></span></div><br>_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br></blockquote></div><br></div>