Logging into your docker registry fails with x509 certificate signed by unknown authority error

Problem

You cannot log in to your docker registry. The error return is: x509: certificate signed by unknown authority.

Cause

You are using a self-signed certificate for your docker registry instead of the certificate issued by the trusted certificate authority (CA). The docker daemon does not trust the self-signed certificate which causes the x509 error.

Diagnose

When you try to log in to your docker registry, the x509: certificate signed by unknown authority error is returned.

  docker login <your_docker_registry_host>:<your_docker_registry_port> -u <user> -p <password>

For example:

  docker login bordure-inf.fyre.ibm.com:5555 -u admin -p Passw0rd

  Error response from daemon: Get https://bordure-inf.fyre.ibm.com:5555/v2/: x509: certificate signed by unknown authority

Resolving the problem

You must instruct docker to trust the self-signed certificate by copying the self-signed certificate to /etc/docker/certs.d/<your_registry_host_name>:<your_registry_host_port>/ca.crt on the machine where you are running the docker login command.

1. Create the following directory on the server where you are running docker login.

   mkdir -p /etc/docker/certs.d/<your_registry_host_name>:<your_registry_host_port>
   

2. Copy your docker registry certificate file from your docker registry host to the cluster where you are running docker login. Rename your docker registry certificate file to /etc/docker/certs.d/<your_registry_host_name>:<your_registry_host_port>/ca.crt.

   scp <your_registry_host_name>:/opt/registry/certs/domain.crt /etc/docker/certs.d/<your_registry_host_name>:<your_registry_host_port>/ca.crt
   

   For example:

   mkdir -p /etc/docker/certs.d/bordure-inf.fyre.ibm.com:5555
   scp bordure-inf.fyre.ibm.com:/opt/registry/certs/domain.crt /etc/docker/certs.d/bordure-inf.fyre.ibm.com:5555/ca.crt
   

3. Then, log in to your docker registry again.