From 1f0e0155dc666f9b0a6c963fdb3fd2e7d9edb0a6 Mon Sep 17 00:00:00 2001
From: Arash Deshmeh <adeshmeh@ca.ibm.com>
Date: Sat, 25 Feb 2017 15:17:23 -0500
Subject: [PATCH] use an encrypted client certificate to connect to a docker
 daemon

Signed-off-by: Arash Deshmeh <adeshmeh@ca.ibm.com>
Upstream-commit: 603dd8b3b48273c0c7e1f2aef5f344acac66424e
Component: engine
---
 components/engine/cli/command/cli.go    | 22 ++++++++++++++++++++++
 components/engine/client/client_test.go |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/components/engine/cli/command/cli.go b/components/engine/cli/command/cli.go
index 6194bae1cc..45752d7d55 100644
--- a/components/engine/cli/command/cli.go
+++ b/components/engine/cli/command/cli.go
@@ -20,6 +20,7 @@ import (
 	dopts "github.com/docker/docker/opts"
 	"github.com/docker/go-connections/sockets"
 	"github.com/docker/go-connections/tlsconfig"
+	"github.com/docker/notary/passphrase"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"golang.org/x/net/context"
@@ -153,9 +154,30 @@ func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions) error {
 
 	var err error
 	cli.client, err = NewAPIClientFromFlags(opts.Common, cli.configFile)
+	if tlsconfig.IsErrEncryptedKey(err) {
+		var (
+			passwd string
+			giveup bool
+		)
+		passRetriever := passphrase.PromptRetrieverWithInOut(cli.In(), cli.Out(), nil)
+
+		for attempts := 0; tlsconfig.IsErrEncryptedKey(err); attempts++ {
+			// some code and comments borrowed from notary/trustmanager/keystore.go
+			passwd, giveup, err = passRetriever("private", "encrypted TLS private", false, attempts)
+			// Check if the passphrase retriever got an error or if it is telling us to give up
+			if giveup || err != nil {
+				return errors.Wrap(err, "private key is encrypted, but could not get passphrase")
+			}
+
+			opts.Common.TLSOptions.Passphrase = passwd
+			cli.client, err = NewAPIClientFromFlags(opts.Common, cli.configFile)
+		}
+	}
+
 	if err != nil {
 		return err
 	}
+
 	cli.defaultVersion = cli.client.ClientVersion()
 
 	if opts.Common.TrustKey == "" {
diff --git a/components/engine/client/client_test.go b/components/engine/client/client_test.go
index 64188d5fb1..0816d8a9bf 100644
--- a/components/engine/client/client_test.go
+++ b/components/engine/client/client_test.go
@@ -33,7 +33,7 @@ func TestNewEnvClient(t *testing.T) {
 			envs: map[string]string{
 				"DOCKER_CERT_PATH": "invalid/path",
 			},
-			expectedError: "Could not load X509 key pair: open invalid/path/cert.pem: no such file or directory. Make sure the key is not encrypted",
+			expectedError: "Could not load X509 key pair: open invalid/path/cert.pem: no such file or directory",
 		},
 		{
 			envs: map[string]string{