{"action":"opened","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/1298","labels_url":"https://api.github.com/repos/docker/distribution/issues/1298/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/1298/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/1298/events","html_url":"https://github.com/docker/distribution/issues/1298","id":123783984,"number":1298,"title":"bad certificate","user":{"login":"Haitianisgood","id":9413884,"avatar_url":"https://avatars.githubusercontent.com/u/9413884?v=3","gravatar_id":"","url":"https://api.github.com/users/Haitianisgood","html_url":"https://github.com/Haitianisgood","followers_url":"https://api.github.com/users/Haitianisgood/followers","following_url":"https://api.github.com/users/Haitianisgood/following{/other_user}","gists_url":"https://api.github.com/users/Haitianisgood/gists{/gist_id}","starred_url":"https://api.github.com/users/Haitianisgood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Haitianisgood/subscriptions","organizations_url":"https://api.github.com/users/Haitianisgood/orgs","repos_url":"https://api.github.com/users/Haitianisgood/repos","events_url":"https://api.github.com/users/Haitianisgood/events{/privacy}","received_events_url":"https://api.github.com/users/Haitianisgood/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-24T10:02:40Z","updated_at":"2015-12-24T10:02:40Z","closed_at":null,"body":"I did all following official website.\r\n\r\n https://docs.docker.com/registry/insecure/\r\n\r\n my docker-registry and docker-clent all ubuntu server 14.04  64t\r\n\r\ni add /etc/hosts on docker-registry and docker-clent\r\n\r\n192.168.1.13  www.haitian.com\r\n\r\n\r\n 1. I run \r\n\r\n```\r\nmkdir -p certs && openssl req \\\r\n  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \\\r\n  -x509 -days 365 -out certs/domain.crt\r\n```\r\n\r\nand I be sure to use the name www.haitian.com as a CN.\r\n\r\nThen I copy domain.crt file to\r\n\r\n```\r\n/etc/docker/certs.d/www.haitian.com:5000/ca.crt\r\n```\r\n\r\n on my docker-registry server and docker client \r\n\r\nthen restart all docker\r\n\r\n2. I run \r\n\r\n```\r\ndocker push www.haitian.com:5000/redis\r\n\r\n```\r\n\r\nerror:\r\n\r\nthen docker-regisry server report:\r\n\r\n```\r\n2015/12/24 09:27:54 http: TLS handshake error from 192.168.1.23:59506: remote error: bad certificate\r\n2015/12/24 09:27:54 http: TLS handshake error from 192.168.1.23:59508: remote error: bad certificate\r\n2015/12/24 09:27:54 http: TLS handshake error from 192.168.1.23:59507: remote error: bad certificate\r\n\r\n```\r\n\r\ndocker client  report:\r\n\r\n```\r\nroot@docker-clent:~# docker push www.haitian.com:5000/redis\r\nThe push refers to a repository [www.haitian.com:5000/redis] (len: 1)\r\nunable to ping registry endpoint https://www.haitian.com:5000/v0/\r\nv2 ping attempt failed with error: Get https://www.haitian.com:5000/v2/: x509: certificate has expired or is not yet valid\r\n v1 ping attempt failed with error: Get https://www.haitian.com:5000/v1/_ping: x509: certificate has expired or is not yet valid\r\n\r\n```\r\nand run:\r\n\r\nroot@docker-registry:~# curl -iv https://www.haitian.com:5000\r\n\r\n```\r\n\r\n* Rebuilt URL to: https://www.haitian.com:5000/\r\n* Hostname was NOT found in DNS cache\r\n*   Trying 192.168.1.13...\r\n* Connected to www.haitian.com (192.168.1.13) port 5000 (#0)\r\n* successfully set certificate verify locations:\r\n*   CAfile: none\r\n  CApath: /etc/ssl/certs\r\n* SSLv3, TLS handshake, Client hello (1):\r\n* SSLv3, TLS handshake, Server hello (2):\r\n* SSLv3, TLS handshake, CERT (11):\r\n* SSLv3, TLS alert, Server hello (2):\r\n* SSL certificate problem: unable to get local issuer certificate\r\n* Closing connection 0\r\ncurl: (60) SSL certificate problem: unable to get local issuer certificate\r\nMore details here: http://curl.haxx.se/docs/sslcerts.html\r\n\r\ncurl performs SSL certificate verification by default, using a \"bundle\"\r\n of Certificate Authority (CA) public keys (CA certs). If the default\r\n bundle file isn't adequate, you can specify an alternate file\r\n using the --cacert option.\r\nIf this HTTPS server uses a certificate signed by a CA represented in\r\n the bundle, the certificate verification probably failed due to a\r\n problem with the certificate (it might be expired, or the name might\r\n not match the domain name in the URL).\r\nIf you'd like to turn off curl's verification of the certificate, use\r\n the -k (or --insecure) option.\r\n\r\n```\r\n"}}