Dozzle TLS Setup: Handling ‘unknown certificate authority’ Connection Errors

[Akila1996522]

I got this error before setup TLS and after setup TLS

{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","endpoint":"82.232.45.12:7007","time":"2025-07-02T12:47:48Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: unknown certificate authority\"","endpoint":"23.67.110.54:7007","time":"2025-07-02T12:47:48Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","time":"2025-07-02T12:47:48Z","message":"error listing containers"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: unknown certificate authority\"","time":"2025-07-02T12:47:48Z","message":"error listing containers"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","endpoint":"82.232.45.12:7007","time":"2025-07-02T12:48:50Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: unknown certificate authority\"","endpoint":"23.67.110.54:7007","time":"2025-07-02T12:48:50Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","time":"2025-07-02T12:48:50Z","message":"error listing containers"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: unknown certificate authority\"","time":"2025-07-02T12:48:50Z","message":"error listing containers"}

The Master Host docker-compose.yml file is mentioned below

services:
  dozzle:
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - .users.yml:/data
    ports:
      - 8080:8080
    environment:
      - "DOZZLE_REMOTE_AGENT=82.232.45.12:7007,23.67.110.54:7007"
      - "DOZZLE_AUTH_PROVIDER=simple"
      - "DOZZLE_AUTH_TTL=48h"

secrets:
  users:
    file: dozzle/users.yml

volumes:
  dozzle:

The agent docker-compose.yml file is mentioned below.

services:
  dozzle-agent:
    image: amir20/dozzle:latest
    command: agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    secrets:
      - source: cert
        target: /dozzle_cert.pem
      - source: key
        target: /dozzle_key.pem
    ports:
      - 7007:7007
secrets:
  cert:
    file: ./cert.pem
  key:
    file: ./privkey.pem

How to fix this issue?

[amir20]

You need to also provide those TLS certs to the UI. The certs are for UI --> agent communication.

[Akila1996522]

Could you explain how can do this?

[amir20]

Just use the same secret block.

secrets:
      - source: cert
        target: /dozzle_cert.pem
      - source: key
        target: /dozzle_key.pem

secrets:
  cert:
    file: ./cert.pem
  key:
    file: ./privkey.pem

[Akila1996522]

Thank you for your response. I tried with this docker-compose.yml for UI server

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - .users.yml:/data
#      - /etc/letsencrypt/live/dozzle.echonlabs.com/:/certs
    ports:
      - 8080:8080
    environment:
      - "DOZZLE_REMOTE_AGENT=82.232.45.12:7007,23.67.110.54:7007"
      - "DOZZLE_AUTH_PROVIDER=simple"
      - "DOZZLE_AUTH_TTL=48h"
    secrets:
      - source: cert
        target: /dozzle_cert.pem
      - source: key
        target: /dozzle_key.pem

secrets:
  cert:
    file: cert.pem
  key:
    file: privkey.pem
  users:
    file: dozzle/users.yml

volumes:
  dozzle:

And agent docker-compose.yml with below YAML file

services:
  dozzle-agent:
    image: amir20/dozzle:latest
    command: agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 7007:7007
    secrets:
      - source: cert
        target: /dozzle_cert.pem
      - source: key
        target: /dozzle_key.pem

secrets:
  cert:
    file: cert.pem
  key:
    file: privkey.pem

volumes:
  dozzle:

I got same TLS certificate for installed to UI application to agent server. Now coming these logs from UI server

{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","endpoint":"82.232.45.12:7007","time":"2025-07-04T10:27:19Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","endpoint":"23.67.110.54:7007","time":"2025-07-04T10:27:20Z","message":"error fetching host info for agent"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","time":"2025-07-04T10:27:20Z","message":"error listing containers"}
{"level":"warn","version":"v8.13.4","error":"rpc error: code = Unavailable desc = connection error: desc = \"error reading server preface: remote error: tls: certificate required\"","time":"2025-07-04T10:27:20Z","message":"error listing containers"}

How to fix these issues?

[amir20]

I have seen this error when certs are not configured correctly. I won't be able to help you. I recommend you stick to the default certs.