Discuss Docker DCA Exam Topic 4 Question 117

You are pulling images from a Docker Trusted Registry installation

configured to use self-signed certificates, and this error appears:

`x509: certificate signed by unknown authority.

You already downloaded the Docker Trusted Registry certificate authority

certificate from https://dtr.example.com/ca.

How do you trust it? (Select two.)

APass '-trust-certificate ca.crt to the Docker client.

BPlace the certificate in '/etc/docker/dtr/dtr.example.com.crt' and restart theDocker daemon on all cluster nodes.

CPlace the certificate in /etc/docker/certs.d/dtr.example.com/ca.crt' on allcluster nodes.

DPass -- insecure-registry to the Docker client.

EPlace the certificate in your OS certificate path, trust the certificate system-wide, and restart the Docker daemon across all cluster nodes.

Suggested Answer: C, E

To trust a self-signed certificate from a Docker Trusted Registry (DTR), you need to place the certificate in the appropriate location on all cluster nodes and restart the Docker daemon. There are two possible locations for the certificate, depending on your OS and Docker version1:

*/etc/docker/certs.d/dtr.example.com/ca.crt: This is the preferred location for Linux systems and Docker versions 1.13 and higher. This directory is scanned by Docker for certificates and keys for each registry domain2.

*Your OS certificate path: This is the fallback location for other OSes and Docker versions. You need to find the certificate store for your OS and copy the certificate there. You also need to trust the certificate system-wide, which may require additional steps depending on your OS3.

The other options are not correct because:

*Passing '-trust-certificate ca.crt to the Docker client is not a valid option. There is no such flag for the Docker client4.

*Placing the certificate in '/etc/docker/dtr/dtr.example.com.crt' is not a valid location. The certificate should be in the /etc/docker/certs.d directory, not the /etc/docker/dtr directory1.

*Passing -- insecure-registry to the Docker client is not a recommended option. This flag disables the TLS verification for the registry, which makes the communication insecure and vulnerable to attacks.

*Use self-signed certificates | Docker Docs

*Test an insecure registry | Docker Docs

*Add TLS certificates as a trusted root authority to the host OS | Docker Docs

*docker | Docker Docs

*[Deploy a registry server | Docker Docs]

Get Premium DCA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Mable 6 months ago

I agree with B and E. Proper setup is crucial for security.

Viva 6 months ago

I believe E is essential. Trusting system-wide is safer.

Ramonita 7 months ago

I’m leaning towards A and C. A seems like a quick fix.

Adell 7 months ago

This question is tricky. I think B and E are the right answers.

Carmen 7 months ago

I thought using --insecure-registry was enough, but I guess not!

Domingo 7 months ago

Wait, why do we need to restart the Docker daemon? Seems excessive.

Meghann 7 months ago

I think option E is also valid, right?

Hillary 7 months ago

Totally agree, option C is the way to go!

Malcom 8 months ago

Haha, who needs security when you can just use --insecure-registry? What could go wrong?

Tyisha 8 months ago

E sounds like a lot of work, I'll stick with C.

Jillian 8 months ago

D? Really? That's just asking for trouble.

Ligia 9 months ago

C is the way to go, easy peasy.

Loren 9 months ago

A and C are the correct options.

Dean 9 months ago

I vaguely recall that using the '--insecure-registry' option is a workaround, but it doesn't really solve the certificate trust issue, right?

Katina 9 months ago

I’m a bit confused about whether we need to restart the Docker daemon after placing the certificate. I feel like that was mentioned in one of the study sessions.

Armanda 9 months ago

I think I practiced a similar question where we had to trust a self-signed certificate, and I feel like option C sounds right for that.

Armanda 9 months ago

I remember something about placing certificates in specific directories, but I'm not sure if it's the '/etc/docker/certs.d/' path or something else.

Lauran 10 months ago

This is a good one. I'm pretty confident that the right approach is to add the certificate to the OS certificate path and trust it system-wide, as described in option E. That's the most robust and secure solution.

Felicitas 10 months ago

I'm not sure about passing the --insecure-registry flag. That seems a bit sketchy to me. I think we want to properly trust the certificate instead of just disabling the security check.

Dexter 10 months ago

Okay, I've got this. We need to add the certificate to the Docker configuration on all the cluster nodes. Option C looks like the right way to do that. Easy peasy!

Ernestine 10 months ago

You need to place the cert in /etc/docker/certs.d/ for it to work.

Vivan 11 months ago

I feel the same! B is definitely needed to restart the daemon.

Terina 11 months ago

I think D is misleading. It’s not a secure solution.

Roslyn 11 months ago

Hmm, this is tricky. I'm a bit confused about the difference between the Docker client and the Docker daemon. I'll need to think this through carefully.

Truman 11 months ago

I think the key here is to trust the certificate authority certificate that we've already downloaded. Looks like options B and C are the way to go, but I'm not sure which one is better.

Salome 6 months ago

↳ replying to Truman

Either way, we need to restart the Docker daemon after.

Johana 6 months ago

↳ replying to Truman

But B might be more secure in the long run.

Santos 6 months ago

↳ replying to Truman

I think C is easier to manage across nodes.

Jeannine 10 months ago

↳ replying to Truman

B and C both seem valid.

Lilli 11 months ago

↳ replying to Truman

I agree, trusting the CA certificate is crucial.

Docker DCA Exam - Topic 4 Question 117 Discussion