Docker login cannot Validate Certificate error with VMware Harbor and UAA

Products

• VMware Tanzu Kubernetes Grid Integrated Edition

Issue/Introduction

Symptoms:

When using docker client CLI to login to the VMware Harbor Registry's IP address as "$ docker login X.X.X.X" as an example, it fails with the following error:

"cannot validate certificate for X.X.X.X because it doesn't contain any IP SANs"    

 

Environment

Cause

The certificate generated for the Harbor VM is generated for the FQDN Hostname of the Harbor instance therefore you need to login to docker using the FQDN and not the IP.
 

 

Resolution

Follow the steps to resolve this issue:

1. Confirm the FQDN Hostname being used for the Harbor Registry. Login to the Pivotal Cloud Foundry Operations Manager URL, navigate to VMware Harbor Registry tile, go to Settings and select General.
2. Get the correct DNS entry added to your organization's DNS servers per step 2 of the pivotal docs
3. Now use the FQDN for your docker client

$ docker login FQDN