topic Re: Harmony SASE - Issue with Docker Pulls – TLS Certificate Error in SASE and Remote Access

Harmony SASE - Issue with Docker Pulls – TLS Certificate Error

Geomix7 — Thu, 11 Sep 2025 05:13:45 GMT

Hello Team ,

when trying to fetch from docker we are receiveing the following error :

"failed to solve: php:8.1-apache-bullseye: failed to resolve source metadata for docker.io/library/php:8.1-apache-bullseye: failed to do request: Head "registry-1.docker.io/v2/library/php/manifests/8.1-apache-bullseye": tls: failed to verify certificate: x509: certificate signed by unknown authority"

I noticed that nothing appears in the logs. To make it work, I had to create a bypass rule for the following Docker-related domains:

registry-1.docker.io
auth.docker.io
production.cloudflare.docker.com

Could you please advise:

Are there best practices we can apply to avoid this issue in the future (e.g., handling TLS inspection with Docker Hub traffic)?
Why doesn’t this behavior appear in the logs, and is there a way to improve visibility for similar cases?

Thanks in advance for your guidance.

Re: Harmony SASE - Issue with Docker Pulls – TLS Certificate Error

G_W_Albrecht — Thu, 11 Sep 2025 07:02:27 GMT

I would suggest to open SR# with CP TAC !

Re: Harmony SASE - Issue with Docker Pulls – TLS Certificate Error

PhoneBoy — Thu, 11 Sep 2025 14:53:15 GMT

Not sure if Docker has a mechanism to update the Trusted CAs (needed for HTTPS Inspection to work) or if they implement Certificate Pinning (in which case, HTTPS Inspection won't work and you will need to bypass as you've done).

Re: Harmony SASE - Issue with Docker Pulls – TLS Certificate Error

Pedro_Espindola — Fri, 12 Sep 2025 16:20:55 GMT

Are you sure the Harmony SASE CA was correctly added to the trusted CA list of the system?

You can also create bypass rules for programs. In linux that would be /usr/bin/dockerd and /usr/bin/docker-proxy. In Windows, that's probably "Docker Desktop.exe", but I have not tested this one.