title: Provide SSL certificate for dockerd for own docker registry
body: <h1>how to provide own CA Root certificate and SSL Client certificate (cert + key) to dockerd in gitlab-ci pipeline for own docker registry?</h1>
  
  <p>I have virtual machine (CentOS 7) and installed docker and gitlab-runner. The runner is registred as <code>docker:dind</code>. The setup works OK but i am having trouble connecting to my own docker registry that has certificate from my own CA, but is also using <strong>client SSL certificate</strong>. When i pass to <code>dockerd</code> the argument <code>--insecure-registry=gitlab.mazel.tov:4567</code> it doesnt verify the CA but i still dont know how to provide the Client SSL certificate and pipile will fail with this error.</p>
  
  <pre><code>$ docker login -u gitlab-ci-token -p $CI_JOB_TOKEN https://gitlab.mazel.tov:4567
  WARNING! Using --password via the CLI is insecure. Use --password-stdin.
  Error response from daemon: Get https://gitlab.mazel.tov:4567/v2/: error parsing HTTP 400 response body: invalid character '&lt;' looking for beginning of value: "&lt;html&gt;\r\n&lt;head&gt;&lt;title&gt;400 No required SSL certificate was sent&lt;/title&gt;&lt;/head&gt;\r\n&lt;body bgcolor=\"white\"&gt;\r\n&lt;center&gt;&lt;h1&gt;400 Bad Request&lt;/h1&gt;&lt;/center&gt;\r\n&lt;center&gt;No required SSL certificate was sent&lt;/center&gt;\r\n&lt;hr&gt;&lt;center&gt;nginx&lt;/center&gt;\r\n&lt;/body&gt;\r\n&lt;/html&gt;\r\n"
  </code></pre>
  
  <p>I also have folder inside <strong>docker:dind</strong> container with my certs, but this approach doesnt work with <code>dockerd</code>? But on my computer or on server it works ok.</p>
  
  <pre><code>$ ls -la /etc/docker/certs.d/gitlab.mazel.tov\:4567/
      ca.crt
      client.cert
      client.key
  </code></pre>
  
  <p>I also explored <code>dockerd --help</code> but the option about certificates are only for the docker socket and i SSL configs for docker registry. </p>
  
  <p><strong>/etc/gitlab-runner/config.toml</strong></p>
  
  <pre><code>[[runners]]
    name = "My Docker Runner"
    url = "https://gitlab.mazel.tov"
    token = "ac17ab5cfff675fddd059d40a3"
    tls-ca-file = "/etc/ssl/certs/myCA.pem"
    tls-cert-file = "/etc/gitlab-runner/certs/mazel.tov.pem"
    tls-key-file = "/etc/gitlab-runner/certs/mazel.tov.key"
    executor = "docker"
    [runners.docker]
      image = "docker:dind"
      privileged = true
      disable_cache = false
      volumes = ["/cache", "/etc/docker/certs.d:/etc/docker/certs.d"]
      shm_size = 0
    [runners.cache]
  </code></pre>
  
  <p><strong>.gitlab-ci.yml</strong></p>
  
  <pre><code>services:
    - name: docker:dind
      command: ["--insecure-registry=gitlab.mazel.tov:4567"]
  
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_HOST: tcp://docker:2375/
  
  stages:
    - build
  
  before_script:
    - ls -la /etc/docker/certs.d/gitlab.mazel.tov\:4567/
    - docker info
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN https://gitlab.mazel.tov:4567
  
  build-web:
    stage: build
    script:
      - docker build ...
      - docker push ...
  </code></pre>
  
  <p>I dont like the --insecure-registry option neither. And my gitlab server has the client certificate configured on the Nginx level.</p>
  
  <p><strong>/etc/gitlab/gitlab.rb</strong></p>
  
  <pre><code>nginx['ssl_client_certificate'] = "/etc/gitlab/ssl/myCA.crt"
  nginx['ssl_verify_client'] = "on"
  </code></pre>
  
  <p>The certificates works OK on my machine and other server, i am just having trouble implementing it with gitlab-ci pipeline...</p>
  
  <p>When I test the docker:dind on my mac and mount certificates it works OK, so the problem is only in the gitlab-ci pipeline? Maybe the dockerd is loaded before the mount folder occurs? </p>
  
  <pre><code>docker run -it --rm --privileged -v ~/.docker/certs.d/:/etc/docker/certs.d/ docker:dind sh
  dockerd &amp;
  docker login https://gitlab.mazel.tov:4567
  ** it works **
  </code></pre>