anchor.diff:  $ sudo mkdir -p /etc/docker/certs.d/docker-registry.default.svc.cluster.local:5000
   $ sudo cp ca.crt /etc/docker/certs.d/docker-registry.default.svc.cluster.local:5000
   ----
  -+
  -. Remove `--insecure-registry` option from docker unit file (*/etc/sysconfig/docker*). Only for this particular registry.
  -  Reload daemon and restart docker service to reflect this config change.
  -+
  +====
  ++
  +. Remove the `--insecure-registry` option from docker unit file in
  +*/etc/sysconfig/docker*, only for this particular registry. Then, reload the
  +daemon and restart the docker service to reflect this configuration change:
  ++
  +====
   ----
   $ sudo systemctl daemon-reload
   $ sudo systemctl restart docker
   ----
  -+
  -. Validate docker client connection. docker push to registry or docker pull from registry should succeed.
  -+
  +====
  ++
  +. Validate the docker client connection. Running `docker push` to the registry or `docker pull` from the registry should succeed:
  ++
  +====
  +[options="nowrap"]
   ----
   $ docker pull busybox
   $ docker tag docker.io/busybox 172.30.124.220:5000/openshift/busybox
  
positive.code: cf2616975b4a: Image successfully pushed
  Digest: sha256:3662dd821983bc4326bee12caec61367e7fb6f6a3ee547cbaff98f77403cab55
  ----
  
negative.code: $ oc log docker-registry-1-da73t | grep tls
  time="2015-05-27T05:05:53Z" level=info msg="listening on :5000, tls" instance.id=deeba528-c478-41f5-b751-dc48e4935fc2
  ----
  ====
  +
  . Copy the CA certificate to the docker certificates directory. This must be
  done on all nodes in the cluster:
  +
  ====
  [options="nowrap"]
  ----
  $ sudo mkdir -p /etc/docker/certs.d/172.30.124.220:5000
  $ sudo cp ca.crt /etc/docker/certs.d/172.30.124.220:5000
  