- [Instructor] When it comes to Universal Control Plane
and the Docker Trusted Registry,
all communications use HTTPS.
However, by default,
this is done with a self-signed security certificate.
And, so what that means is when you connect
your web browser to UCP or DTR,
you get that warning that your connection is not private.
And you have to go to advanced,
and you have to click to proceed anyway.
And that doesn't make you feel very secure,
and in fact it's not that secure.
So what they recommend
is that you use an external certificate with UCP.
So let me show you how that's done.
Here in UCP, to configure external security certificates,
you go into administrative settings
and then into certificates.
And it's here that you would upload private keys,
upload your server certificate and your CA certificate,
and then click save.
Now this would have to be done,
as it says at the top here,
on all UCP managers
and this is something that
you would want to do outside of normal business hours.
I mean, your containers
would continue to run no matter what,
because this just affects the Universal Control Plane,
but administrators would lose access to UCP
and you also have to download new client bundles
for anyone using the CLI to access UCP.
Now when it comes to Docker Trusted Registry,
if you go into system,
and then down to domains and proxies here,
it says show TLS settings.
And here again they have the exact same type
of security certificates that you can actually paste
in here to configure and then click save.
More information on using your own TLS certificates
is available over in the docker documentation
where they walk you through this process both for UCP
as well as for Docker Trusted Registry.