I'm trying to setup a private docker registry based on the documentation of https://docs.docker.com/registry/deploying/#running-a-domain-registry.

I'm using StartSSL as certificate issuer, downloaded their intermediate crt's and combined them with my client certificate:

cd certs    
cat sca.server3.crt ca.crt client.pem  > client.crt

After starting the registry with

docker run --rm -p 5000:5000 --name registry -v `pwd`/certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/client.crt -e REGISTRY_HTTP_TLS_KEY=/certs/private.key registry:2

the registry complains about mismatching private/public key. However the very same certificate + private key works in some other Apache site. I didn't get that error before I had added the intermediate crt's to the client.crt

time="2016-07-18T11:34:19Z" level=fatal msg="crypto/tls: private key does not match public key"

As the registry is running inside an intranet (not public internet) I don't want to setup an apache/nginx just to act as proxy.

Sidenote: I'm using Docker Mac (Docker version 1.12.0-rc4, build e4a0dbc, experimental).


As I remeber the order on how you combine your certificates is important.

try the bottom up approach:

cat domain.crt intermediate-certificates.pem ca.pem > chained-domain.crt

  • 1
    can also use certificatechain.io to help build the chain properly. Hasn't done me wrong yet! – emmdee Apr 3 '18 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.