1

I'm trying to setup a private docker registry based on the documentation of https://docs.docker.com/registry/deploying/#running-a-domain-registry.

I'm using StartSSL as certificate issuer, downloaded their intermediate crt's and combined them with my client certificate:

cd certs    
cat sca.server3.crt ca.crt client.pem  > client.crt

After starting the registry with

docker run --rm -p 5000:5000 --name registry -v `pwd`/certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/client.crt -e REGISTRY_HTTP_TLS_KEY=/certs/private.key registry:2

the registry complains about mismatching private/public key. However the very same certificate + private key works in some other Apache site. I didn't get that error before I had added the intermediate crt's to the client.crt

time="2016-07-18T11:34:19Z" level=fatal msg="crypto/tls: private key does not match public key"

As the registry is running inside an intranet (not public internet) I don't want to setup an apache/nginx just to act as proxy.

Sidenote: I'm using Docker Mac (Docker version 1.12.0-rc4, build e4a0dbc, experimental).

Improve this question

1 Answer 1

Reset to default
2

As I remeber the order on how you combine your certificates is important.

try the bottom up approach:

cat domain.crt intermediate-certificates.pem ca.pem > chained-domain.crt

Improve this answer
1
  • 1
    can also use certificatechain.io to help build the chain properly. Hasn't done me wrong yet!
    – emmdee
    Apr 3, 2018 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .