{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/8849","labels_url":"https://api.github.com/repos/docker/docker/issues/8849/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/8849/comments","events_url":"https://api.github.com/repos/docker/docker/issues/8849/events","html_url":"https://github.com/docker/docker/issues/8849","id":47230040,"number":8849,"title":"access private registry: x509: certificate signed by unknown authority","user":{"login":"hustcat","id":1716915,"avatar_url":"https://avatars.githubusercontent.com/u/1716915?v=3","gravatar_id":"","url":"https://api.github.com/users/hustcat","html_url":"https://github.com/hustcat","followers_url":"https://api.github.com/users/hustcat/followers","following_url":"https://api.github.com/users/hustcat/following{/other_user}","gists_url":"https://api.github.com/users/hustcat/gists{/gist_id}","starred_url":"https://api.github.com/users/hustcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hustcat/subscriptions","organizations_url":"https://api.github.com/users/hustcat/orgs","repos_url":"https://api.github.com/users/hustcat/repos","events_url":"https://api.github.com/users/hustcat/events{/privacy}","received_events_url":"https://api.github.com/users/hustcat/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2014-10-30T03:31:00Z","updated_at":"2015-01-20T02:30:41Z","closed_at":"2014-11-04T00:55:08Z","body":"I setup docker-registry with nginx by following [here](https://github.com/docker/docker-registry/blob/master/contrib/nginx/nginx_1-3-9.conf).\r\n\r\nI run 'docker login', get this error:\r\n```sh\r\n# docker login -u docker -p docker -e xx@xxx.com https://dev.registry.com\r\n2014/10/30 11:12:08 Error response from daemon: Server Error: Post https://dev.registry.com/v1/users/: x509: certificate signed by unknown authority\r\n```\r\n\r\ndocker daemon's output:\r\n```sh\r\n[debug] server.go:1181 Calling POST /auth\r\n[info] POST /v1.15/auth\r\n[47687bb1] +job auth()\r\n[debug] endpoint.go:109 Error unmarshalling the _ping RegistryInfo: json: cannot unmarshal bool into Go value of type registry.RegistryInfo\r\n[debug] endpoint.go:113 Registry version header: '0.7.1'\r\n[debug] endpoint.go:116 RegistryInfo.Version: \"0.7.1\"\r\n[debug] endpoint.go:119 Registry standalone header: 'True'\r\n[debug] endpoint.go:127 RegistryInfo.Standalone: true\r\n[debug] endpoint.go:109 Error unmarshalling the _ping RegistryInfo: json: cannot unmarshal bool into Go value of type registry.RegistryInfo\r\n[debug] endpoint.go:113 Registry version header: '0.7.1'\r\n[debug] endpoint.go:116 RegistryInfo.Version: \"0.7.1\"\r\n[debug] endpoint.go:119 Registry standalone header: 'True'\r\n[debug] endpoint.go:127 RegistryInfo.Standalone: true\r\nServer Error: Post https://dev.registry.com/v1/users/: x509: certificate signed by unknown authority\r\n[47687bb1] -job auth() = ERR (1)\r\n[error] server.go:1207 Handler for POST /auth returned error: Server Error: Post https://dev.registry.com/v1/users/: x509: certificate signed by unknown authority\r\n[error] server.go:110 HTTP Error: statusCode=500 Server Error: Post https://dev.registry.com/v1/users/: x509: certificate signed by unknown authority\r\n```\r\nI checked the code. I think function Login may be need 'tlsConfig' \r\nhttps://github.com/docker/docker/blob/master/registry/auth.go#L163\r\n\r\njust like \r\nhttps://github.com/docker/docker/blob/master/registry/registry.go#L49\r\n\r\n```sh\r\n# docker --version\r\nDocker version 1.3.0, build c78088f\r\n```\r\n\r\n```sh\r\n# curl --cacert ca.pem https://dev.registry.com/v1/_ping                 \r\ntrue\r\n# curl --cacert ca.pem -u docker:docker https://dev.registry.com/v1/users/\r\n\"OK\"\r\n\r\n# curl -u docker:docker https://dev.registry.com/v1/users/                \r\ncurl: (60) Peer certificate cannot be authenticated with known CA certificates\r\nMore details here: http://curl.haxx.se/docs/sslcerts.html\r\n\r\ncurl performs SSL certificate verification by default, using a \"bundle\"\r\n of Certificate Authority (CA) public keys (CA certs). If the default\r\n bundle file isn't adequate, you can specify an alternate file\r\n using the --cacert option.\r\nIf this HTTPS server uses a certificate signed by a CA represented in\r\n the bundle, the certificate verification probably failed due to a\r\n problem with the certificate (it might be expired, or the name might\r\n not match the domain name in the URL).\r\nIf you'd like to turn off curl's verification of the certificate, use\r\n the -k (or --insecure) option.\r\n```"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/70595191","html_url":"https://github.com/docker/docker/issues/8849#issuecomment-70595191","issue_url":"https://api.github.com/repos/docker/docker/issues/8849","id":70595191,"user":{"login":"grimmy","id":1396385,"avatar_url":"https://avatars.githubusercontent.com/u/1396385?v=3","gravatar_id":"","url":"https://api.github.com/users/grimmy","html_url":"https://github.com/grimmy","followers_url":"https://api.github.com/users/grimmy/followers","following_url":"https://api.github.com/users/grimmy/following{/other_user}","gists_url":"https://api.github.com/users/grimmy/gists{/gist_id}","starred_url":"https://api.github.com/users/grimmy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grimmy/subscriptions","organizations_url":"https://api.github.com/users/grimmy/orgs","repos_url":"https://api.github.com/users/grimmy/repos","events_url":"https://api.github.com/users/grimmy/events{/privacy}","received_events_url":"https://api.github.com/users/grimmy/received_events","type":"User","site_admin":false},"created_at":"2015-01-20T02:30:41Z","updated_at":"2015-01-20T02:30:41Z","body":"If you've installed the cert globally (via ca-certificates) make sure you restart docker as it won't reload the global ssl certs.  That said, mine still isn't working, but I ran into that at work :)"}}