title: Configuring local registry with self-signed certificate
body: <p>I want to configure a local docker registry with self-signed certificate which i will be using inside my local network. I'm following instruction from docker manual [1, 2], but nevertheless run into errors.</p>
  
  <p>Precisely, my problem is following. I create a self signed certificate on the local registry machine:</p>
  
  <pre><code>openssl req \                                 
    -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
    -x509 -days 365 -out certs/domain.crt \
    -subj "/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=openmpi-dockerregistry.local"
  </code></pre>
  
  <p>I put this certificate into <code>/etc/docker/certs.d/openmpi-dockerregistry:443/ca.crt</code> on each of the local machines.</p>
  
  <p>Then I start registry and push an image there. Since I do not have DNS configured inside my network, I just put an entry into <code>/etc/hosts</code>.</p>
  
  <p>Next I try to pull the image on the local machine, but this operation fails:</p>
  
  <pre><code>$ docker run -it openmpi-dockerregistry.local:443/hello-world
  Unable to find image 'openmpi-dockerregistry.local:443/hello-world:latest' locally
  docker: Error response from daemon: Get https://openmpi-dockerregistry.local:443/v2/: x509: certificate is not valid for any names, but wanted to match openmpi-dockerregistry.local.
  See 'docker run --help'.
  </code></pre>
  
  <p>I'm very suspicious about message "x509: certificate is not valid for any names", which sounds that I did not specify CN correctly, but reading the certificate indicates the opposite (<a href="https://gist.github.com/planetA/83cad9b4c94fca0ff27d155c6bd287d6" rel="noreferrer">full output</a>):</p>
  
  <pre><code> $ openssl x509 -text -noout -in certs/domain.crt
   ....
      Signature Algorithm: sha256WithRSAEncryption
           Issuer: C = US, ST = Oregon, L = Portland, O = Company Name, OU = Org, CN = openmpi-dockerregistry.local
   ....
  </code></pre>
  
  <p>Another option which I tried is to access the register directly by IP. I followed a manual[3] and added IP SAN to the certificate. Additionally I also set CN=*. So that the resulting certificate now contains following (<a href="https://gist.github.com/planetA/e3cb41e5e402941881aa7f1857dd1320" rel="noreferrer">full</a>):</p>
  
  <pre><code>        X509v3 extensions:
              X509v3 Subject Alternative Name: 
                 IP Address:&lt;ip address&gt;
  </code></pre>
  
  <p>But now when I try to pull the image I get following error message:</p>
  
  <pre><code>$ docker run -it  &lt;ip&gt;:443/hello-world
  Unable to find image '&lt;ip&gt;:443/hello-world:latest' locally
  docker: Error response from daemon: Get https://&lt;ip&gt;:443/v2/: x509: cannot validate certificate for &lt;ip&gt; because it doesn't contain any IP SANs.
  See 'docker run --help'
  </code></pre>
  
  <p>Although the file <code>/etc/docker/certs.d/&lt;ip&gt;:443/ca.crt</code> contains the IP address.</p>
  
  <p>Could you help me to find a way to pull images from local registry?</p>
  
  <p><em>Update</em></p>
  
  <p>How do I start docker registry?</p>
  
  <pre><code>$ docker run -d \
     -v `pwd`/certs:/certs \
     -e REGISTRY_HTTP_ADDR=0.0.0.0:$REGISTRY_PORT \
     -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
     -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
     -p $REGISTRY_PORT:$REGISTRY_PORT \
     --restart=always \
     --name registry \
     registry:2
  </code></pre>
  
  <ol>
  <li><a href="https://docs.docker.com/registry/insecure/#use-self-signed-certificates" rel="noreferrer">https://docs.docker.com/registry/insecure/#use-self-signed-certificates</a></li>
  <li><a href="https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry" rel="noreferrer">https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry</a></li>
  <li><a href="https://bowerstudios.com/node/1007" rel="noreferrer">https://bowerstudios.com/node/1007</a></li>
  </ol>