How do I Configure a Docker Registry V2 with Apache and a CA certificate?
<p>I have read all the references here and out on a google search and have been unable to get my registry accessible using a CA signed certificate. Here is what I have:</p>

<p>Apache proxy (have tried various configs, none of which have any effect to docker):</p>

<blockquote>
  <p>listen dockerrepo.xxxxx.xxxxx.xxxxx.com:5000 https
  ServerName dockerrepo.xxxxx.xxxxx.xxxxx.com</p>
  
  <p>
      SSLEngine on
      SSLCertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCACertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCertificateKeyFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCipherSuite AES128-SHA,AES256-SHA,AES128-GCM-SHA256,AES256-GCM-SHA384
      SSLProtocol all -SSLv3 -SSLv2 -TLSv1</p>

<pre><code>Header always set "Docker-Distribution-Api-Version" "registry/2.0"
Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0"
RequestHeader set X-Forwarded-Proto "https"

ProxyPreserveHost on
ProxyPass   /v2 http://127.0.0.1:5000/v2
ProxyPassReverse /v2  http://127.0.0.1:5000/v2
</code></pre>
  
  <p></p>
  
  <p>
      SSLEngine on
      SSLCertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCACertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCertificateKeyFile /etc/httpd/certs/DockerRepoCAKeyCert.crt
      SSLCipherSuite AES128-SHA,AES256-SHA,AES128-GCM-SHA256,AES256-GCM-SHA384
      SSLProtocol all -SSLv3 -SSLv2 -TLSv1</p>

<pre><code>Header always set "Docker-Distribution-Api-Version" "registry/2.0"
Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0"
RequestHeader set X-Forwarded-Proto "https"

ProxyPreserveHost on
ProxyPass   /v2 http://127.0.0.1:5000/v2
ProxyPassReverse /v2  http://127.0.0.1:5000/v2
</code></pre>
  
  <p></p>
</blockquote>

<p>I start the registry:</p>

<blockquote>
  <p>prod=registry
  ver=2.1.1
  docker load --input /home/docker/docker_${prod}-${ver}.tar
  docker run -d --privileged=true -e GUNICORN_OPTS="[--preload]" -p 127.0.0.1:5000:5000 --restart=always -v /home/docker/certs:/ce
  rts -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/DockerRepoCACert.crt -e REGISTRY_HTTP_TLS_KEY=/certs/client-private-key-nopassphrase
  .pem -v /home/docker/prodRepo/data:/tmp/registry-dev --name docker-registry ${prod}:${ver}</p>
</blockquote>

<p>Registry and apache start fine. when I push I get this:</p>

<blockquote>
  <p>[root@dockerrepo dockerrepo:5000]# docker push dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry:2.1.1</p>
  
  <p>The push refers to a repository [dockerrepo.internal.acp.arris.com:5000/registry] (len: 1)</p>
  
  <p>unable to ping registry endpoint <a href="https://dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/v0/" rel="nofollow">https://dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/v0/</a></p>
  
  <p>v2 ping attempt failed with error: Get https: //dockerrepo.xxxxx.xxxxx.xxxx.com:5000/v2/: x509: certificate signed by 
  unknown authority</p>
  
  <p>v1 ping attempt failed with error: Get https: //dockerrepo.xxxxx.xxxxxx.xxxxx.com:5000/v1/_ping: x509: certificate signed by unknown authority</p>
</blockquote>

<p>I have tried combining the domain, intermediate/sub and root certs in all combinations, but I can't seem to get this to work. I suspect I am doing something silly, but I can't see what. Any help is appreciated.</p>

<p>After checking, I realized I had not added my cert to the CA trust. After doing this, I now get this error:</p>

<blockquote>
  <p>[root@dockerrepo anchors]# docker push dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry:2.1.1</p>
  
  <p>The push refers to a repository [dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry] (len: 1)</p>
  
  <p>1e847b14150e: Buffering to Disk</p>
  
  <p>Received unexpected HTTP status: 502 Proxy Error</p>
</blockquote>