尝试登录到受信任的（？）Docker注册表时出现X509错误

Question

I have set up a docker registry using harbor.

I have copied the appropriate certificates in /usr/share/local/ca-certificates and run sudo update-ca-certificates with success. (indicated the number of newly certs added).

When trying to login to the specific registry:

ubuntu@master1:/home/vagrant$ docker login my.registry.url
Username: pkaramol
Password: 
Error response from daemon: Get https://my.registry.url/v2/: x509: certificate signed by unknown authority

However the following test succeeds:

openssl s_client -connect my.registry.url:443 -CApath /etc/ssl/certs/

...coming back with a lot of verbose output, the certificate itself and ending in :

Verify return code: 0 (ok)

curl also succeeds to the above https link (it fails when the site is not trusted).

Any suggestions?

Answer 1

If you read the documentation

Use self-signed certificates

Warning: Using this along with basic authentication requires to also trust the certificate into the OS cert store for some versions of docker (see below) This is more secure than the insecure registry solution.

Generate your own certificate:

$ mkdir -p certs

$ openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

Be sure to use the name myregistrydomain.com as a CN.

Use the result to start your registry with TLS enabled.

Instruct every Docker daemon to trust that certificate. The way to do this depends on your OS.

Linux: Copy the domain.crt file to /etc/docker/certs.d/myregistrydomain.com:5000/ca.crt on every Docker host. You do not need to restart Docker.

See below link for more details

https://docs.docker.com/registry/insecure/#use-self-signed-certificates