docker client can't read from both “docker private registry” and “online docker registry” if custom ssl certificate are used

0
votes

Docker version 1.2.0, build 2a2f26c/1.2.0,

docker registry 0.8.1

i setup docker private registry on cenots7 and created my custom ssl cert. when I try to access my docker registry using https I get x509: certificate signed by unknown authority. i found a solution for this by placing the cert file under "/etc/pki/tls/certs" then do

"update-ca-trust"

"service docker restart"

now it started to read my certificate.i can login and pull and push to docker private registry

"https://localdockerregistry".

now when i tries to read from online docker registry(https://index.docker.io/v1/search?q=centos) like

"docker search centos"

i get

"Error response from daemon: Get https://index.docker.io/v1/search?q=centos: x509: certificate signed by unknown authority"

i exported docker.io cert from firefox brower and put it under "/etc/pki/tls/certs" then do "update-ca-trust" and "service docker restart" but same error. it looks like docker client cant decide which cert to use for which repository.

Any ideas how we can fix "x509: certificate signed by unknown authority" for online docker registry while using your own docker private registry.

2
docker

2 Answers

3
votes

The correct place to put the certificate is on the machine running your docker daemon (not the client) in this location: /etc/docker/certs.d/my.registry.com:5000/ca.crt where my.registry.com:5000 is the address of your private registry and :5000 is the port where your registry is reachable. If the path /etc/docker/certs.d/ does not exist, you should create it -- that is where the Docker daemon will look by default.

This way you can have a private certificate per private registry and not affect the public registry.

This is per the docs on http://docs.docker.com/reference/api/registry_api/

0
votes

I had the problem with a docker registry running in a container behind a Nginx proxy with a StartSSL certificate.

In that case you have to append the intermediate ca certs to the nginx ssl certificate, see https://stackoverflow.com/a/25006442/1130611