{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/850","labels_url":"https://api.github.com/repos/docker/distribution/issues/850/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/850/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/850/events","html_url":"https://github.com/docker/distribution/issues/850","id":100353584,"number":850,"title":"TLS handshake error with Registry 2.0.1","user":{"login":"Trefex","id":2877665,"avatar_url":"https://avatars.githubusercontent.com/u/2877665?v=3","gravatar_id":"","url":"https://api.github.com/users/Trefex","html_url":"https://github.com/Trefex","followers_url":"https://api.github.com/users/Trefex/followers","following_url":"https://api.github.com/users/Trefex/following{/other_user}","gists_url":"https://api.github.com/users/Trefex/gists{/gist_id}","starred_url":"https://api.github.com/users/Trefex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Trefex/subscriptions","organizations_url":"https://api.github.com/users/Trefex/orgs","repos_url":"https://api.github.com/users/Trefex/repos","events_url":"https://api.github.com/users/Trefex/events{/privacy}","received_events_url":"https://api.github.com/users/Trefex/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-11T16:34:02Z","updated_at":"2015-08-11T19:19:12Z","closed_at":null,"body":"Dear all,\r\n\r\nI have the following problem. When I connect to registry via ATS -> nginx -> registry, I get a TLS handshake error and everything fails. If I connect via nginx -> registry, I get a SSL authority error which is normal since the nginx certs are self-signed. The ATS is mandatory and has a proper certificate as shown below.\r\n\r\nSetup:\r\n\r\n* apache traffic server (in front of VM, no control, proper certificate)\r\n* nginx 1.9.3 compiled with ldap support (self-signed)\r\n* registry 2.0.1 started as container\r\n* Docker 1.7.1 client and server \r\n\r\nCommand to start registry\r\n\r\n```bash\r\ndocker run -p 127.0.0.1:5000:5000 -v /etc/nginx/certs:/certs -v /mnt/data/docker-data:/data -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certdomain.key -e REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data --name registry registry:2.0.1\r\n```\r\n\r\nAttempt to login to new registry\r\n\r\n```\r\n~ ❯ docker login docker-r3lab.uni.lu                                                                                                                                                                           06:19:17 ⏎\r\nUsername: christophe.trefois\r\nPassword:\r\nEmail:\r\nError response from daemon: Unexpected status code [404] : <html>\r\n<head><title>404 Not Found</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx/1.9.3</center>\r\n</body>\r\n</html>\r\n```\r\n\r\nLog from boot2docker\r\n\r\n```\r\nDEBU[0010] Calling POST /auth\r\nINFO[0010] POST /v1.19/auth\r\nDEBU[0010] pinging registry endpoint https://docker-r3lab.uni.lu/v0/\r\nDEBU[0010] attempting v2 ping for registry endpoint https://docker-r3lab.uni.lu/v2/\r\nDEBU[0010] hostDir: /etc/docker/certs.d/docker-r3lab.uni.lu\r\nDEBU[0010] attempting v1 ping for registry endpoint https://docker-r3lab.uni.lu/v1/\r\nDEBU[0010] hostDir: /etc/docker/certs.d/docker-r3lab.uni.lu\r\nDEBU[0010] Error unmarshalling the _ping RegistryInfo: invalid character '<' looking for beginning of value\r\nDEBU[0010] RegistryInfo.Version: \"\"\r\nDEBU[0010] Registry standalone header: ''\r\nDEBU[0010] RegistryInfo.Standalone: true\r\nDEBU[0010] attempting v1 login to registry endpoint https://docker-r3lab.uni.lu/v1/\r\nDEBU[0010] hostDir: /etc/docker/certs.d/docker-r3lab.uni.lu\r\nERRO[0011] Handler for POST /auth returned error: Unexpected status code [404] : <html>\r\n<head><title>404 Not Found</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx/1.9.3</center>\r\n</body>\r\n</html>\r\n\r\nERRO[0011] HTTP Error                                    err=Unexpected status code [404] : <html>\r\n<head><title>404 Not Found</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx/1.9.3</center>\r\n</body>\r\n</html>\r\n statusCode=404\r\n```\r\n\r\nLog from nginx debug error log\r\n\r\nhttps://paste.fedoraproject.org/253931/31035514/\r\n\r\nLog from registry container\r\n\r\n```\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57446: tls: first record does not look like a TLS handshake\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57448: tls: first record does not look like a TLS handshake\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57450: tls: first record does not look like a TLS handshake\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57452: tls: first record does not look like a TLS handshake\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57454: tls: first record does not look like a TLS handshake\r\n2015/08/11 16:25:14 http: TLS handshake error from 172.17.42.1:57456: tls: first record does not look like a TLS handshake\r\n```\r\n\r\nOutput from a curl \r\n\r\n```\r\n~ ❯ curl -vi https://docker-r3lab.uni.lu/v2/                                                                                                                                                                    06:27:47\r\n* Hostname was NOT found in DNS cache\r\n*   Trying 10.4.0.57...\r\n* Connected to docker-r3lab.uni.lu (10.4.0.57) port 443 (#0)\r\n* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\r\n* Server certificate: *.uni.lu\r\n* Server certificate: LuxTrust Qualified CA\r\n* Server certificate: LuxTrust root CA\r\n* Server certificate: Baltimore CyberTrust Root\r\n> GET /v2/ HTTP/1.1\r\n> User-Agent: curl/7.37.1\r\n> Host: docker-r3lab.uni.lu\r\n> Accept: */*\r\n>\r\n< HTTP/1.1 502 Invalid HTTP Response\r\nHTTP/1.1 502 Invalid HTTP Response\r\n< Date: Tue, 11 Aug 2015 16:28:23 GMT\r\nDate: Tue, 11 Aug 2015 16:28:23 GMT\r\n< Connection: keep-alive\r\nConnection: keep-alive\r\n* Server ATS/5.2.1 is not blacklisted\r\n< Server: ATS/5.2.1\r\nServer: ATS/5.2.1\r\n< Cache-Control: no-store\r\nCache-Control: no-store\r\n< Content-Type: text/html\r\nContent-Type: text/html\r\n< Content-Language: en\r\nContent-Language: en\r\n< Content-Length: 256\r\nContent-Length: 256\r\n\r\n<\r\n<HTML>\r\n<HEAD>\r\n<TITLE>Web Server Error</TITLE>\r\n</HEAD>\r\n\r\n<BODY BGCOLOR=\"white\" FGCOLOR=\"black\">\r\n<H1>Web Server Error</H1>\r\n<HR>\r\n\r\n<FONT FACE=\"Helvetica,Arial\"><B>\r\nDescription: The host requested  did not return the document correctly.\r\n</B></FONT>\r\n<HR>\r\n</BODY>\r\n* Connection #0 to host docker-r3lab.uni.lu left intact\r\n```\r\n\r\nnginx configuration file\r\n\r\nhttps://paste.fedoraproject.org/253935/14393107/\r\n\r\nDoes anybody have any idea what I can do to debug this or could help me?\r\n\r\nThank you so much,\r\n\r\n--\r\nChristophe"},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/130026624","html_url":"https://github.com/docker/distribution/issues/850#issuecomment-130026624","issue_url":"https://api.github.com/repos/docker/distribution/issues/850","id":130026624,"user":{"login":"Trefex","id":2877665,"avatar_url":"https://avatars.githubusercontent.com/u/2877665?v=3","gravatar_id":"","url":"https://api.github.com/users/Trefex","html_url":"https://github.com/Trefex","followers_url":"https://api.github.com/users/Trefex/followers","following_url":"https://api.github.com/users/Trefex/following{/other_user}","gists_url":"https://api.github.com/users/Trefex/gists{/gist_id}","starred_url":"https://api.github.com/users/Trefex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Trefex/subscriptions","organizations_url":"https://api.github.com/users/Trefex/orgs","repos_url":"https://api.github.com/users/Trefex/repos","events_url":"https://api.github.com/users/Trefex/events{/privacy}","received_events_url":"https://api.github.com/users/Trefex/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T19:19:12Z","updated_at":"2015-08-11T19:19:12Z","body":"Ok, another update.\r\n\r\nSo, it didn't work, because strangely enough I need to disable basic auth for GET in order for the ping to work.\r\n\r\nStill, now I receive the status code 500 error.\r\n\r\nRelevant log from docker daemon \r\n\r\n```bash\r\nDEBU[0556] Calling POST /auth\r\nINFO[0556] POST /v1.19/auth\r\nDEBU[0556] pinging registry endpoint https://docker-r3lab.uni.lu/v0/\r\nDEBU[0556] attempting v2 ping for registry endpoint https://docker-r3lab.uni.lu/v2/\r\nDEBU[0556] hostDir: /etc/docker/certs.d/docker-r3lab.uni.lu\r\nDEBU[0556] attempting v2 login to registry endpoint https://docker-r3lab.uni.lu/v2/\r\nERRO[0556] Handler for POST /auth returned error: no successful auth challenge for https://docker-r3lab.uni.lu/v2/ - errors: []\r\nERRO[0556] HTTP Error                                    err=no successful auth challenge for https://docker-r3lab.uni.lu/v2/ - errors: [] statusCode=500\r\n```"}}