How to update an expired SSL certificate?

[pennypacker]

Hi.
Based on the images you provided, it appears you are using TOS5. In TOS5, you can usually update your eu.tnas.link automatically by simply disabling and then re-enabling the TNAS.online service.
Detailed instructions for this method are available on the first page of this thread.
"(2)If your system version is TOS 4 (excluding models F2-210 and F4-210) or TOS 5, you can update the certificate by restarting the TNAS.online service, provided that the network connection is normal. If the TNAS.online restart is unsuccessful, restarting the entire TNAS device will also complete the certificate update process."

Yes, TOS 5. The instructions worked, thanks.

[macmpi]

TOS 4.2.44 on F2-210 (ARM)

Code: Select all

$ sudo docker pull ghcr.io/tailscale/tailscale:stable
Password: 
stable: Pulling from tailscale/tailscale
d741ee1608f3: Already exists 
c2d5824efcb8: Retrying in 1 second 
7f75f7be1c9d: Retrying in 1 second 
c4122d13ac3f: Retrying in 1 second 
f1878199be32: Waiting 
error pulling image configuration: download failed after attempts=6: x509: certificate signed by unknown authority

Did the TNAS.online start (and stop) and restarted NAS



Thanks for suggestion to fix x509 certificate for docker.

[EriChan]

Please refer to this guide to update your expired certificate first, and then try again.

[macmpi]

Please refer to this guide to update your expired certificate first, and then try again.

I think you mean first post: yes I did that too (BTW, it misses one step to chmod +x downloaded script):


However, even after restart, it does not solve the docker pull error about x509 certificate signed by unknown authority...
(BTW, when logging-into NAS interface from recent Firefox with https, Firefox also complain and have to acknowledge security risks...)

Thanks for any tip to allow successful docker pull with no x509 cert error. (seem this older issue it popping-up again, even with so-called latest docker version)

[Felix]

Please follow the steps below. I have included instructions to backup your original file and a method to restore it later.

Backup the Original File
Before modifying system files, always create a backup:

Code: Select all

sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.bak

Edit the Configuration
Open the configuration file using your preferred editor:

Code: Select all

vi /etc/docker/daemon.json

Update the file with the following content to configure the registry mirror and allow insecure connections for ghcr.io:

Code: Select all

{
  "registry-mirrors": [
    "https://docker.ketches.cn/"
  ],
  "insecure-registries": [
    "ghcr.io"
  ]
}

Restart Docker
Restart the service to apply the new settings:

Code: Select all

/etc/init.d/docker restart

How to Restore Original Configuration
Since adding entries to insecure-registries lowers security by allowing unverified connections, it is recommended to revert the changes after you have finished pulling images.

To restore your original settings:

Stop Docker

Code: Select all

/etc/init.d/docker stop

Restore the backup

Code: Select all

sudo mv /etc/docker/daemon.json.bak /etc/docker/daemon.json

Start Docker

Code: Select all

/etc/init.d/docker start

[macmpi]

Please follow the steps below. I have included instructions to backup your original file and a method to restore it later.

Thanks a lot for the useful workaround: works fine.
Now, is there a possibility TM would ship an updated docker app for TOS 4.2.44 / F2-210, so that we avoid such (even transitional) unsecure setup?
Thanks for consideration.

PS:

Code: Select all

 $ sudo systemctl restart docker
sudo: systemctl: command not found

[Felix]

Please follow the steps below. I have included instructions to backup your original file and a method to restore it later.

Thanks a lot for the useful workaround: works fine.
Now, is there a possibility TM would ship an updated docker app for TOS 4.2.44 / F2-210, so that we avoid such (even transitional) unsecure setup?
Thanks for consideration.

PS:

Code: Select all

 $ sudo systemctl restart docker
sudo: systemctl: command not found

The 210 series are early ARM products. Due to incomplete Docker support for the ARM architecture and architectural limitations in the early days, they could not be upgraded to newer versions.

Thank you for pointing this out; the relevant commands have been updated.

[itectric]

this is not working for me. the commands sudo -i doesnt work. I am in an admin cmd window

[EriChan]

Great to know our live support team got this sorted out for you!

You only need to update according to solution 1 for your situation.

Thank you for reaching out, and feel free to contact us know if you need any further assistance。