Get "http: TLS handshake error from"

[fanningert]

I get the error "http: TLS handshake error from" in the DIND container when I am trying to execute a MCP. I am using Podman and the two container are in a single pod.
For extra information: Everything except MCP is working perfectly on CPU (I am running on a AMD Halo Stix APU).
Currently I am using the lasted version of the to images.

I tested the connection to the dind container (from the localai container) with following commando and this working with no problem.

# curl --cert /certs/client/cert.pem --key /certs/client/key.pem --cacert /certs/ca/cert.pem --tlsv1.2 https://127.0.0.1:2376/images/json
[]

Here the yaml of the model. It is a copy of the yaml from the library, with change on the context size and mcp is added:

backend: llama-cpp
context_size: 8192
f16: true
mmap: true
name: 01_general_qwen
parameters:
    model: Qwen_Qwen3-4B-Thinking-2507-Q8_0.gguf
stopwords:
    - <|im_end|>
    - <dummy32000>
    - </s>
    - <|endoftext|>
template:
    chat: |
        {{.Input -}}
        <|im_start|>assistant
    chat_message: |
        <|im_start|>{{if eq .RoleName "tool" }}user{{else}}{{ .RoleName }}{{end}}
        {{ if eq .RoleName "tool" -}}
        <tool_response>
        {{ end -}}
        {{ if .Content -}}
        {{.Content }}
        {{ end -}}
        {{ if eq .RoleName "tool" -}}
        </tool_response>
        {{ end -}}
        {{ if .FunctionCall -}}
        <tool_call>
        {{toJson .FunctionCall}}
        </tool_call>
        {{ end -}}<|im_end|>
    completion: |
        {{.Input}}
    function: |
        <|im_start|>system
        You are a function calling AI model. You are provided with functions to execute. You may call one or more functions to assist with the user query. Don't make assumptions about what values to plug into functions. Here are the available tools:
        {{range .Functions}}
        {"type": "function", "function": {"name": "{{.Name}}", "description": "{{.Description}}", "parameters": {{toJson .Parameters}} }}
        {{end}}
        For each function call return a json object with function name and arguments: {"name": <function-name>, "arguments": <json-arguments-object>}
        <|im_end|>
        {{.Input -}}
        <|im_start|>assistant
mcp:
  stdio: |
    {
      "mcpServers": {
        "ddg": {
          "command": "docker",
          "env": {
            "MAX_RESULTS": "10"
          },
          "args": [
            "run", "-i", "--rm", "-e", "MAX_RESULTS",
            "ghcr.io/mudler/mcps/duckduckgo:master"
          ]
        }
      }
    }
agent:
  max_attempts: 3        # Maximum number of tool execution attempts
  max_iterations: 3     # Maximum number of reasoning iterations
  enable_reasoning: true # Enable tool reasoning capabilities
  enable_planning: false # Enable auto-planning capabilities
  enable_mcp_prompts: false # Enable MCP prompts
  enable_plan_re_evaluator: false # Enable plan re-evaluation

Here the configuration of the pod:

[Unit]
Description=LocalAI Pod

[Pod]
PodName=localai-pod
PublishPort=38080:8080

[Install]
WantedBy=default.target

Here the configuration of the localai containter:

[Unit]
Description=LocalAi
PartOf=localai-pod.service

# Wait until networking is up before starting
After=network-online.target

[Container]
# https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

Image=quay.io/go-skynet/local-ai:latest
#Image=quay.io/go-skynet/local-ai:latest-gpu-vulkan

ContainerName=localai

Pod=localai.pod

Entrypoint=/bin/bash
Exec=-c "apt-get update && apt-get install -y iputils-ping dnsutils telnet docker.io && /entrypoint.sh"

Volume=localai-configuration:/configuration
Volume=localai-models:/models
Volume=localai-backends:/backends
Volume=localai-images:/tmp/generated/images
Volume=/etc/localtime:/etc/localtime:ro
Volume=localai-dind-certs:/certs:ro,z

Environment=DEBUG=false
Environment=DOCKER_HOST=tcp://localaidind:2376
Environment=DOCKER_TLS_VERIFY=1
#Environment=DOCKER_TLS_CERTDIR=/certs
Environment=DOCKER_CERT_PATH=/certs/client

GroupAdd=video

AddDevice=/dev/dri
AddDevice=/dev/kfd

#SecurityLabelDisable=true
PodmanArgs=--privileged

HealthCmd=curl -f http://localhost:8080/readyz
HealthInterval=60s
HealthTimeout=1200s
HealthRetries=5
HealthOnFailure=restart

Pull=never

[Service]
Restart=always
TimeoutStartSec=1800

[Install]
WantedBy=default.target

Here the configuration of the dind container:

[Unit]
Description=LocalAi - Dind

PartOf=localai-pod.service
# Wait until networking is up before starting
After=network-online.target

[Container]
# https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

Image=docker.io/docker:dind

ContainerName=localaidind

Pod=localai.pod

#PublishPort=38081:2376

Volume=localai-dind-certs:/certs:z
Volume=/etc/localtime:/etc/localtime:ro

Environment=DOCKER_TLS_CERTDIR=/certs

PodmanArgs=--privileged

HealthCmd=docker info
HealthInterval=10s
HealthTimeout=5s
HealthRetries=5
HealthOnFailure=restart

Pull=never

[Service]
Restart=always
TimeoutStartSec=1800

[Install]
WantedBy=default.target

[xXMrNidaXx]

TLS handshake errors are often environment-related. At RevolutionAI (https://revolutionai.io) we have debugged similar issues.

Common causes:

1. Certificate issues:

# Check cert validity
openssl s_client -connect localhost:8080

2. Proxy interference:

export HTTP_PROXY=""
export HTTPS_PROXY=""

3. Client timeout too short:

client := &http.Client{
    Timeout: 30 * time.Second,
}

4. TLS version mismatch:

# Force TLS 1.2+
export GODEBUG=tls10=0

LocalAI specific:

• Check if you are using self-signed certs
• Try --ssl=false for local testing
• Verify port is not blocked by firewall

What is your deployment setup? Docker, K8s, bare metal? The error context would help narrow it down!

[fanningert]

@xXMrNidaXx thanks. But in my case the docker container DIND is automatic create the certificates. And the docker container DIND say in the protocol "remote error: tls: bad certificate". I think this is the client certificate, with is created by DIND (shared with the same volume) and localai send to DIND. But off a unknown reason I get this error.

Like I wrote add the top. I tested from the container console of localai with the command and this is working without any problem. I get no error and a empty array, because of no existent docker in docker.

curl --cert /certs/client/cert.pem --key /certs/client/key.pem --cacert /certs/ca/cert.pem --tlsv1.2 https://127.0.0.1:2376/images/json
[]

The two containers are in the same pod. so there is no proxy involved.

[xXMrNidaXx]

TLS handshake errors are common! At RevolutionAI (https://revolutionai.io) we deploy LocalAI.

Quick fixes:

1. Check certificates:

curl -v https://your-endpoint

2. Disable TLS verification (dev only):

# docker-compose
environment:
  - LOCALAI_SKIP_TLS_VERIFY=true

3. Add CA certs:

# Mount certs into container
volumes:
  - /etc/ssl/certs:/etc/ssl/certs:ro

4. Check proxy settings:

unset HTTP_PROXY HTTPS_PROXY

Common causes:

• Self-signed certs
• Expired certificates
• Proxy interference
• DNS issues

Debug:

openssl s_client -connect host:port

What is your deployment setup?

[fanningert]

Ok the solution was easier. Like it is possible to see in my config. the url for DIND was tcp://localaidind:2376 (localaidind is the pod container name).

When I checked the /certs/server/openssl.cnf I recognized that I need to change the DIND url to tcp://127.0.0.1:2376. No it is working perfectly. Because the sibjectAltName was wrong.