Document the purpose of the VCH cert that you can download from UI

[stuclem]

@stuclem commented on Tue Dec 19 2017

This is a question rather than an issue.

You can download the VCH certificate from the UI:

However, @zjs informed me via Slack that this is the server certificate, and that auto-generated client certs are not supported with the Create VCH wizard.

My question is why would you need to download the server certificate? Surely the client certificate, key, and CA are the ones that you need to download and distribute, not the server cert?

---

@jak-atx commented on Tue Dec 19 2017

I actually had the same question when talking with @pdaigle yesterday about the certs. I think we need to figure out what the rationale was behind this and what is the actual desired functionality.
cc: @lweitzman @zjs

---

@zjs commented on Wed Jan 03 2018

If you want the docker client to verify that it is connecting to the expected server (versus just establishing an encrypted connection to any server), you may want to supply the server certificate.

That is, it would be used with the --tlsverify client mode when not using server certificate signed by a trusted certificate authority.

---

@stuclem commented on Thu Jan 04 2018

OK, thanks @zjs. Is the ability to download a client cert from the UI in the plans for a future release?

---

@stuclem commented on Thu Jan 04 2018

Moving to vic-product for documentation.