Issue in adding SSL certificate with Clair2.1.7

[vippujain]

About Clair Infra Setup:
I am using Clair version 2.1.7 for security scan and using Klar to trigger scan on Clair. Clair is configured in a VM and Klar is triggered from another VM.

Clair VM Setup -
I am running a docker container for Clair on the host network and Klar access Clair API to run a scan.

Problem Statement:
I am trying to add SSL certificates with Clair but after adding certificates, the connection is not working between Clair and Klar. and the error is -

Can't dump HTTP reqsponse read tcp <Klar_VM>:60992-><Clair_VM>:6060: read: connection reset by peer
Failed to analyze using API v1: push image https://quay.io/v2/coreos/clair:sha256:0962dd91c2f5de60ea2c0019fb275bc463fce6f59db96597e09e645627439909 to Clair facp <Klar_VM>:60992-><Clair_VM>:6060: read: connection reset by peer

Failed to analyze using API v3: push image https://quay.io/v2/coreos/clair:sha256:0962dd91c2f5de60ea2c0019fb275bc463fce6f59db96597e09e645627439909 to Clair fa = transport is closing

My config file after added certificate changes-

# Copyright 2015 clair authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Reference config: https://github.com/quay/clair/blob/v2.1.7/config.example.yaml

# The values specified here are the default values that Clair uses if no configuration file is specified or if the keys are not defined.
clair:
  database:
    # Database driver
    type: pgsql
    options:
      # PostgreSQL Connection string
      # https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-CONNSTRING
      source: postgresql://postgres:password@localhost:5432?sslmode=disable

      # Number of elements kept in the cache
      # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
      cachesize: 16384

      # 32-bit URL-safe base64 key used to encrypt pagination tokens
      # If one is not provided, it will be generated.
      # Multiple clair instances in the same cluster need the same value.
      paginationkey:

  api:
    # v3 grpc/RESTful API server address
    addr: "0.0.0.0:6060"

    # Health server address
    # This is an unencrypted endpoint useful for load balancers to check to healthiness of the clair server.
    healthaddr: "0.0.0.0:6061"

    # Deadline before an API request will respond with a 503
    timeout: 900s

    # Optional PKI configuration
    # If you want to easily generate client certificates and CAs, try the following projects:
    # https://github.com/coreos/etcd-ca
    # https://github.com/cloudflare/cfssl
    keyfile: "/config/clair.test.prv"
    certfile: "/config/clair.test.crt"

  updater:
    # Frequency the database will be updated with vulnerabilities from the default data sources
    # The value 0 disables the updater entirely.
    interval: 5m
    enabledupdaters:
      - alpine
      - aws
      - debian
      - oracle
      - rhel
      - suse
      - ubuntu

  notifier:
    # Number of attempts before the notification is marked as failed to be sent
    attempts: 3

    # Duration before a failed notification is retried
    renotifyinterval: 2h

    http:
      # Optional endpoint that will receive notifications via POST requests
      endpoint:

      # Optional PKI configuration
      # If you want to easily generate client certificates and CAs, try the following projects:
      # https://github.com/cloudflare/cfssl
      # https://github.com/coreos/etcd-ca
      servername:
      cafile:
      keyfile:
      certfile:

      # Optional HTTP Proxy: must be a valid URL (including the scheme).
      proxy:

Expected Outcome

Clair scan result should be output.

CLAIR_ADDR=<Clair_DNS> CLAIR_OUTPUT=Unknown CLAIR_THRESHOLD=10 DOCKER_TIMEOUT=1200 CLAIR_TIMEOUT=2000 JSON_OUTPUT=true DOCKER_USER=**** DOCKER_PASSWORD=**** klar quay.io/coreos/clair@sha256:0962dd91c2f5de60ea2c0019fb275bc463fce6f59db96597e09e645627439909

Actual Outcome

Can't dump HTTP reqsponse read tcp 10.132.1.9:60992->10.132.1.10:6060: read: connection reset by peer
Failed to analyze using API v1: push image https://quay.io/v2/coreos/clair:sha256:0962dd91c2f5de60ea2c0019fb275bc463fce6f59db96597e09e645627439909 to Clair facp 10.132.1.9:60992->10.132.1.10:6060: read: connection reset by peer

Failed to analyze using API v3: push image https://quay.io/v2/coreos/clair:sha256:0962dd91c2f5de60ea2c0019fb275bc463fce6f59db96597e09e645627439909 to Clair fa = transport is closing

Failed to analyze, exiting

Environment

• Clair version/image: 2.1.7
• Clair client name/version: 2.1.7
• Host OS: Ubuntu 20.04.2 LTS
• Kernel (e.g. uname -a): azure VM
• Kubernetes version (use kubectl version): NA
• Network/Firewall setup: this works fine. Clair is working without SSl certs

[vippujain]

can someone help in configuring tls in Clair 2.1.7?