Problems setting up artifactory as a docker registry

Question

im currently trying to setup a private Docker Registry in Artifacory (v4.7.4).

I've setup a local,remote and virtual docker Repository, added Apache as a Reverse Proxy. Added a DNS Entry for the virtual "docker" Repo.

Reverse Proxy is working but if i try something like:

docker pull docker.my.company.com/ubuntu:16.04

I'm getting:

https://docker.my.company.com/v1/_ping : x509: certificate is valid for *.company.com, company.com, not docker.my.company.com

My Artifactory URL is: "my.company.com/artifactory" and i want the repositorys to be accessible on repo.my.company.com/artifactory.

I also have a Wildcard Certificate for company.com so i don't understand whats the problem here.

Or is there a way to access Artifactory over just http without SSL

Any Ideas?

Answer 1

According to the RFC-2818 Wildcard certificate matches only the one level down domains, but not deeper:

Eg, *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

In this case what you should do is use ports for mapping repositories, instead of subdomains, so the docker repository will be accessible under, for example my.company.com:5001/ instead of docker.my.company.com .

You can find the explanation about the change and how to do it using Artifactory Proxy settings generator in the User Guide .

Answer 2

If you are prepared to live with the certificate-name mismatch for-now, and understand the security implications of ignoring the name-mismatch and accessing the repo insecurely, you can apply the following workaround:

• Edit /etc/default/docker and add the option DOCKER_OPTS="--insecure-registry docker.my.company.com" .
• Restart docker: [sudo] service docker restart .