title: Docker Registry incorrectly claims an expired CA cert
body: <p>I followed the Docker Registry installation docs precisely, and have a registry running on a remote Ubuntu VM. On that VM, the Docker container is running with the following command:</p>
  
  <pre><code>docker run -d -p 5000:5000 --restart=always --name registry \
      -v `pwd`/auth:/auth \
      -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
      -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
      -v `pwd`/certs:/certs \
      -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
      -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
      registry:2
  </code></pre>
  
  <p>On the remote VM, I have the following directory structure:</p>
  
  <pre><code>/home/myuser/
      certs/
          registry.crt
          registry.key
  /etc/docker/certs.d/myregistry.example.com:5000/
      ca.crt
      ca.key
  </code></pre>
  
  <p>The <code>ca.crt</code> is the same exact cert as <code>~/certs/registry.crt</code> (just renamed); same goes for <code>ca.key</code> and <code>registry.key</code> being the same/just renamed. I created the <code>ca*</code> files per a suggestion from the error output you'll see below.</p>
  
  <p>I am <em>almost</em> 100% sure the CA cert is still valid, although any help ruling that out (e.g. how can I actually tell?) would be appreciated. When I start the container and look at the Docker logs, I don't see any errors.</p>
  
  <p>I then attempt to login from my local laptop (Mac):</p>
  
  <pre><code>docker login myregistry.example.com:5000
  </code></pre>
  
  <p>It queries me for my username, password and <em>email</em> (although I don't recall ever specifying an email when setting up Basic Auth). After entering these <em>correctly</em> (I have checked and double checked...) I get the following error:</p>
  
  <pre><code>myuser@mymachine:~/tmp$docker login myregistry.example.com:5000
  Username: my_ciuser
  Password: 
  Email: myuser@example.com
  Error response from daemon: invalid registry endpoint https://myregistry.example.com:5000/v0/:
  unable to ping registry endpoint https://myregistry.example.com:5000/v0/ v2 ping attempt failed with error:
  Get https://myregistry.example.com:5000/v2/: x509: certificate has expired or is not yet valid
  v1 ping attempt failed with error: Get https://myregistry.example.com:5000/v1/_ping: x509:
  certificate has expired or is not yet valid. If this private registry supports only HTTP or
  HTTPS with an unknown CA certificate, please add 
  `--insecure-registry myregistry.example.com:5000` to the daemon's
  arguments. In the case of HTTPS, if you have access to the registry's CA
  certificate, no need for the flag; simply place the CA certificate
  at /etc/docker/certs.d/myregistry.example.com:5000/ca.crt
  </code></pre>
  
  <p>So from my perspective, I guess the following are possible:</p>
  
  <ul>
  <li>The CA cert is invalid (<em>if so, why?!?</em>)</li>
  <li>The CA cert is an intermediary cert (<em>if so, how can I tell?</em>)</li>
  <li>The CA cert is expired (<em>if so, how do I tell?</em>)</li>
  <li>This is a bad error message, and some other facet of the registry is not configured properly (<em>if so, how do I troubleshoot further?</em>)</li>
  <li>Perhaps my cert is not located in the correct place on the server, or doesn't have the right permissions set (<em>if so, where does the cert need to be?</em>)</li>
  <li>Something else that I would never expect in a million years</li>
  </ul>
  
  <p>Any ideas/thoughts?</p>