无法通过 TLS 推送到私有 docker 注册表

Question

I have QNAP NAS behind my router with public IP 1.2.3.4. I have certificate for xxxx.yyyy.cz. The certificate is valid, I am able to reach my NAS over HTTPS. I installed docker registry:2.7 on my NAS. This is container environment configuratin:

REGISTRY_HTTP_ADDR  0.0.0.0:5443
REGISTRY_HTTP_TLS_CERTIFICATE   /certs/client.cert
REGISTRY_HTTP_TLS_KEY   /certs/client.key

I set up port forwarding 5443 to 5443 TCP. In certs directory are 3 files:

/certs # ls -al                                                                                                                                                                                
total 24                                                                                                                                                                                       
drwxrwxrwx    2 root     root          4096 Oct 20 17:02 .                                                                                                                                     
drwxr-xr-x    1 root     root          4096 Oct 20 17:01 ..                                                                                                                                    
-rwxrwxrwx    1 root     root          1688 Oct 20 16:42 ca.crt                                                                                                                                
-rwxrwxrwx    1 root     root          2060 Oct 20 16:42 client.cert                                                                                                                           
-rwxrwxrwx    1 root     root          1704 Oct 20 16:42 client.key 

I am able to get response from registry with curl or via browser:

$ curl --cacert Downloads/certs/ca.crt https://xxxx.yyyy.cz:5443/v2/_catalog ; echo $?
{"repositories":[]}
0

So I am sure certificate are right and registry is running correctly. When I see the container logs, I am still receiving this messages:

2019/10/20 17:51:10 http: TLS handshake error from 1.2.3.4:58164: tls: first record does not look like a TLS handshake
2019/10/20 17:51:30 http: TLS handshake error from 1.2.3.4:58334: tls: first record does not look like a TLS handshake
2019/10/20 17:51:50 http: TLS handshake error from 1.2.3.4:58498: tls: first record does not look like a TLS handshake
2019/10/20 17:52:11 http: TLS handshake error from 1.2.3.4:58654: tls: first record does not look like a TLS handshake
2019/10/20 17:52:31 http: TLS handshake error from 1.2.3.4:58810: tls: first record does not look like a TLS handshake
2019/10/20 17:52:51 http: TLS handshake error from 1.2.3.4:58982: tls: first record does not look like a TLS handshake
2019/10/20 17:53:12 http: TLS handshake error from 1.2.3.4:59136: tls: first record does not look like a TLS handshake

When I try to push something to my registry, I am receiving error:

$ docker push xxxx.yyyy.cz:5443/myimage:latest
The push refers to repository [xxxx.yyyy.cz:5443/myimage]
Get https://xxxx.yyyy.cz:5443/v2/: x509: certificate signed by unknown authority

and in docker logs I can see error message:

2019/10/20 18:43:28 http: TLS handshake error from 1.2.3.4:41632: remote error: tls: bad certificate

I used this and this instructions, but it did not helped. After I logged to the container, I checked my cert files sha256, they are okay.

1. How can I use TLS on my docker registry and why it does not accept my certs?
2. Why it does not work via docker command?

Answer 1

I had problem with client.cert . It should contains also ca.crt as its mentioned here in section USE AN INTERMEDIATE CERTIFICATE :

A certificate issuer may supply you with an intermediate certificate. In this case, you must concatenate your certificate with the intermediate certificate to form a certificate bundle. You can do this using the cat command:

cat domain.crt intermediate-certificates.pem > certs/domain.crt

You can use the certificate bundle just as you use the domain.crt file in the previous example.