如何使用 Apache 和 CA 证书配置 Docker Registry V2？

Question

我已阅读此处的所有参考资料，并在 google 搜索中找到，但无法使用 CA 签名证书访问我的注册表。这是我所拥有的：

Apache 代理（尝试了各种配置，都对 docker 没有任何影响）：

听 dockerrepo.xxxxx.xxxxx.xxxxx.com:5000 https 服务器名称 dockerrepo.xxxxx.xxxxx.xxxxx.com

SSLEngine 开启 SSLCertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCACertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCertificateKeyFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCipherSuite AES128-SHA、AES256-SHA、AES128-GCM-SHA256、AES256-GCM-SHA384 SSLProtocol all -SSLv3 -SSLv2 -TLSv1

Header always set "Docker-Distribution-Api-Version" "registry/2.0"
Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0"
RequestHeader set X-Forwarded-Proto "https"

ProxyPreserveHost on
ProxyPass   /v2 http://127.0.0.1:5000/v2
ProxyPassReverse /v2  http://127.0.0.1:5000/v2

SSLEngine 开启 SSLCertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCACertificateFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCertificateKeyFile /etc/httpd/certs/DockerRepoCAKeyCert.crt SSLCipherSuite AES128-SHA、AES256-SHA、AES128-GCM-SHA256、AES256-GCM-SHA384 SSLProtocol all -SSLv3 -SSLv2 -TLSv1

Header always set "Docker-Distribution-Api-Version" "registry/2.0"
Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0"
RequestHeader set X-Forwarded-Proto "https"

ProxyPreserveHost on
ProxyPass   /v2 http://127.0.0.1:5000/v2
ProxyPassReverse /v2  http://127.0.0.1:5000/v2

我启动注册表：

prod=注册表 版本=2.1.1 docker load --input /home/docker/docker_${prod}-${ver}.tar docker run -d --privileged=true -e GUNICORN_OPTS="[--preload]" -p 127.0.0.1:5000:5000 --restart=always -v /home/docker/certs:/ce rts -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/DockerRepoCACert.crt -e REGISTRY_HTTP_TLS_KEY=/certs/client-private-key-nopassphrase .pem -v /home/docker/prodRepo/data:/tmp/registry-dev --name docker-registry ${prod}:${ver}

注册表和 apache 启动正常。当我推动时，我得到了这个：

[root@dockerrepo dockerrepo:5000]# docker push dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry:2.1.1

推送指的是存储库 [dockerrepo.internal.acp.arris.com:5000/registry] (len: 1)

无法 ping 注册表端点 https://dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/v0/

v2 ping 尝试失败并出现错误：获取 https://dockerrepo.xxxxx.xxxxx.xxxx.com:5000/v2/:x509:certificate signed by 未知权限

v1 ping 尝试失败并出现错误：Get https://dockerrepo.xxxxx.xxxxxx.xxxxx.com:5000/v1/_ping: x509: certificate signed by unknown authority

我已尝试将域、中间/子证书和根证书以所有组合方式组合在一起，但我似乎无法使其正常工作。我怀疑我在做一些愚蠢的事情，但我看不出是什么。任何帮助表示赞赏。

检查后，我意识到我没有将我的证书添加到 CA 信任中。执行此操作后，我现在收到此错误：

[root@dockerrepo 锚点]# docker push dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry:2.1.1

推送指的是存储库 [dockerrepo.xxxxx.xxxxx.xxxxx.com:5000/registry] (len: 1)

1e847b14150e：缓冲到磁盘

收到意外的 HTTP 状态：502 代理错误

Answer 1

您是否确定 CA 证书位于主机上的以下目录中？

   /etc/docker/certs.d/<registry-host>:<registry-port>/