Trying to connect to agent but getting "tls: certificate required"

[ihaettypo]

So I've set up my agent running on a remote host with custom certifiacates. The agent logs "Loaded custom dozzle certificate and key, so I assume it has no sure.

Then I tried to connect to the agent from my main instance, but no matter how I tried I'm still getting this error:

dozzle  | {"level":"warn","version":"v8.12.13","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","time":"2025-05-01T03:15:01Z","message":"error listing containers"}

Here are the compose for my agent:

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    restart: unless-stopped
    command: agent # Agent mode
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    secrets:
      - target: /dozzle_cert.pem
        source: cert
      - target: /dozzle_key.pem
        source: key
    networks:
      - network
    ports:
      - 7007:7007
    environment:
      DOZZLE_AGENT_ADDR: :7007

secrets:
  cert:
    file: ./dozzle.crt
  key:
    file: ./dozzle.key

networks:
  dozzle:
    driver: bridge

And for my main instance, I tried "prividing the same certs" via (the domain name is just an example):

    secrets:
      - target: /certs/my-agent-domain.com/cert.pem # for agent communications
        source: cert
      - target: /certs/my-agent-domain.com/key.pem
        source: key

And:

    secrets:
      - target: /dozzle_cert.pem
        source: cert
      - target: /dozzle_key.pem
        source: key

Neither worked.

Am I doing anything wrong?

[amir20]

And for my main instance, I tried "prividing the same certs" via (the domain name is just an example):

That sounds wrong. You are not supposed to provide domain certs.

You need to mount dozzle_cert.pem and dozzle_key.pem for both UI and agent with exact same certs. Are you doing that?

Share both compose files.

[ihaettypo]

I just tried this with the main instance:

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/yz-lib/dozzle:/data
    secrets:
      - target: /dozzle_cert.pem
        source: cert
      - target: /dozzle_key.pem
        source: key
    networks:
      - network
    environment:
      DOZZLE_LEVEL: info
      DOZZLE_ENABLE_SHELL: "true"
      DOZZLE_ENABLE_ACTIONS: "true"
      DOZZLE_AUTH_PROVIDER: simple
      DOZZLE_AUTH_TTL: 175320h
      DOZZLE_REMOTE_AGENT: "my-agent-domain.com:7007"

secrets:
  cert:
    file: ./dozzle.crt
  key:
    file: ./dozzle.key

networks:
  dozzle:
    driver: bridge

The key-crt pairs are exactly the same as the agent. And I'm seeing this:

dozzle  | {"level":"info","version":"v8.12.13","time":"2025-05-01T03:40:55Z","message":"Loaded custom dozzle certificate and key"}
dozzle  | {"level":"warn","version":"v8.12.13","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","endpoint":"my-agent-domain.com:7007","time":"2025-05-01T03:40:55Z","message":"error fetching host info for agent"}

[amir20]

Does it work without custom certs? It's kinda late here so I am going to be soon. But I can try generating certs and seeing if it works.

[ihaettypo]

It worked without custom certs. Maybe something wrong with my certs? I will try again on my end too. Thank you so much, have a good night.

[amir20]

Hi @ihaettypo,

It worked for me.

services:
  ui:
    image: amir20/dozzle:latest
    restart: unless-stopped
    secrets:
      - target: /dozzle_cert.pem
        source: cert
      - target: /dozzle_key.pem
        source: key
    ports:
      - target: 8080
        published: 8080
    environment:
      DOZZLE_REMOTE_AGENT: 192.168.68.62:7007
secrets:
  cert:
    file: ./shared_cert.pem
  key:
    file: ./shared_key.pem

and

services:
  agent:
    image: amir20/dozzle:latest
    restart: unless-stopped
    command: agent # Agent mode
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    secrets:
      - target: /dozzle_cert.pem
        source: cert
      - target: /dozzle_key.pem
        source: key
    ports:
      - 7007:7007

secrets:
  cert:
    file: ./shared_cert.pem
  key:
    file: ./shared_key.pem

I noticed in your example you had dozzle.crt and dozzle.key. You might be generating something wrong here. I used the following which is also in the documentation too.

openssl genpkey -algorithm Ed25519 -out shared_key.pem
openssl req -new -key shared_key.pem -out shared_request.csr -subj "/C=US/ST=California/L=San Francisco/O=Dozzle"
openssl x509 -req -in shared_request.csr -signkey shared_key.pem -out shared_cert.pem -days 365

Notice these all create .pem files

I am creating Ed25519 which should be generate a certificate and private key.

Hope this helps.

[ihaettypo]

It worked — thank you so much for going to such lengths to help me. It seems the problem was that my CI/CD tool cached the old certificates I tested with, causing inconsistency between the agent and main.