docker - X509 : certfificate signed by unknown authority when using docker login from a remote machine

Question

我正在尝试访问一个私有(private)关系 repo 。在同一网络上的远程计算机上使用 docker 登录，尽管我已按照 docker 文档中的说明进行操作，但我仍然收到 x509: certfificate signed by unknown authority 错误，
我在 centOs 8 机器上，使用 nexus OSS 3.29.2-02 ，我已经根据以下文档 Configuring SSL 配置了 repo
我已经使用 java keytool 创建了自签名证书，当我从同一台机器上的浏览器和远程机器上访问它时，它可以工作，在 /app/sonatype-work/nexus3/log/nexus.log 日志文件没有错误。
我已将证书 .cer 复制到 /etc/docker/certs.d/domain:port/ 位置，然后我还将它复制到 /etc/pki/ca-trust/source/anchors/ 并运行 sudo update-ca-trust 根据 docker 文档:
docker insecure registry
当 i keytool -printcert -sslserver domain:port -v 从远程机器打印证书时。
当我从远程机器 wget 时它工作并且证书已成功验证并下载数据。
我检查了很多主题，但都在谈论将证书放在上述位置，我已经完成了。
提前致谢。
- - - - - - - - - - - 更新 - - - - - - - - - - - - -

[mehdilapin@localhost ~]$ wget https://mycustomregistry.com:7575
--2021-04-11 14:53:59--  https://mycustomregistry.com:7575/
Auflösen des Hostnamens mycustomregistry.com (mycustomregistry.com)… 192.168.1.9
Verbindungsaufbau zu mycustomregistry.com (mycustomregistry.com)|192.168.1.9|:7575 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
Länge: 8903 (8,7K) [text/html]
Wird in »index.html.2« gespeichert.

index.html.2                                         100%[=====================================================================================================================>]   8,69K  --.-KB/s    in 0s      

2021-04-11 14:53:59 (287 MB/s) - »index.html.2« gespeichert [8903/8903]

[mehdilapin@localhost ~]$ sudo keytool -printcert -sslserver mycustomregistry.com:4563/registry/api -v
Certificate #0
====================================
Eigentümer: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Aussteller: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Seriennummer: 68e917a2
Gültig von: Sun Apr 11 14:34:54 CET 2021 bis: Mon Apr 11 14:34:54 CET 2022
Zertifikatsfingerprints:
     SHA1: 05:95:71:99:93:D1:30:A0:D1:82:0C:73:61:47:69:F0:2A:A4:52:B3
     SHA256: EA:8A:0A:0C:C6:4B:BE:73:57:78:CC:DC:08:DE:92:8E:04:6F:B8:3E:8F:2A:71:C8:AD:5A:E7:19:BB:31:7C:AE
Signaturalgorithmusname: SHA256withRSA
Public Key-Algorithmus von Subject: 2048-Bit-RSA-Schlüssel
Version: 3

Erweiterungen: 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: EF C5 91 38 62 ED 54 12   4E AA 9C 0F C6 73 F2 0C  ...8b.T.N....s..
0010: 83 BF CA 5E                                        ...^
]
]

[mehdilapin@localhost ~]$ sudo keytool -printcert -file /etc/docker/certs.d/mycustomregistry.com\:4563/ca-certificate.cer 
Eigentümer: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Aussteller: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Seriennummer: 68e917a2
Gültig von: Sun Apr 11 14:34:54 CET 2021 bis: Mon Apr 11 14:34:54 CET 2022
Zertifikatsfingerprints:
     SHA1: 05:95:71:99:93:D1:30:A0:D1:82:0C:73:61:47:69:F0:2A:A4:52:B3
     SHA256: EA:8A:0A:0C:C6:4B:BE:73:57:78:CC:DC:08:DE:92:8E:04:6F:B8:3E:8F:2A:71:C8:AD:5A:E7:19:BB:31:7C:AE
Signaturalgorithmusname: SHA256withRSA
Public Key-Algorithmus von Subject: 2048-Bit-RSA-Schlüssel
Version: 3

Erweiterungen: 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: EF C5 91 38 62 ED 54 12   4E AA 9C 0F C6 73 F2 0C  ...8b.T.N....s..
0010: 83 BF CA 5E                                        ...^
]
]


[mehdilapin@localhost ~]$ sudo keytool -printcert -file /etc/pki/ca-trust/source/anchors/ca-certificate.cer -v
Eigentümer: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Aussteller: CN=mycustomregistry.com, OU=organization Unit, O=organization, L=USA, ST=NewYork, C=US
Seriennummer: 68e917a2
Gültig von: Sun Apr 11 14:34:54 CET 2021 bis: Mon Apr 11 14:34:54 CET 2022
Zertifikatsfingerprints:
     SHA1: 05:95:71:99:93:D1:30:A0:D1:82:0C:73:61:47:69:F0:2A:A4:52:B3
     SHA256: EA:8A:0A:0C:C6:4B:BE:73:57:78:CC:DC:08:DE:92:8E:04:6F:B8:3E:8F:2A:71:C8:AD:5A:E7:19:BB:31:7C:AE
Signaturalgorithmusname: SHA256withRSA
Public Key-Algorithmus von Subject: 2048-Bit-RSA-Schlüssel
Version: 3

Erweiterungen: 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: EF C5 91 38 62 ED 54 12   4E AA 9C 0F C6 73 F2 0C  ...8b.T.N....s..
0010: 83 BF CA 5E                                        ...^
]
]

Answer 1

/etc/docker/certs.d/ 中的证书需要采用 x509 格式并使用 crt 扩展名命名(实际上可以使用同一文件夹配置客户端 tls 设置)。所以重命名:

/etc/docker/certs.d/mycustomregistry.com\:4563/ca-certificate.cer

到 x509/pem 格式的证书，名为:

/etc/docker/certs.d/mycustomregistry.com\:4563/ca-certificate.crt

这并不能解释为什么操作系统证书不起作用。使用 wget 和 curl 检查时，您应该能够访问 v2 api，即使它给您一个权限被拒绝错误:

curl https://mycustomregistry.com:4563/v2/