【发布时间】：2014-08-27 12:10:53
【问题描述】：
我们的服务器通过代理访问互联网。当我尝试运行诸如
之类的拉取命令时sudo docker run -t -i ubuntu:14.04 /bin/bash
我收到以下错误：
Get https://index.docker.io/v1/repositories/ubuntu/images: tls: failed to parse
certificate from server: x509: negative serial number
wget 命令wget -S -d -O - https://get.docker.io 产生以下输出：
设置--output-document (outputdocument) to - DEBUG output created 通过 linux-gnu 上的 Wget 1.13.4。
URI 编码 =
UTF-8' URI encoding =UTF-8' --2014-08-27 17:13:46-- https://get.docker.io/ 正在连接：... 已连接。创建套接字 3. 释放 0x00000000016829f0（新引用计数 0）。删除未使用的 0x00000000016829f0.---请求开始--- CONNECT get.docker.io:443 HTTP/1.1 User-Agent: Wget/1.13.4 (linux-gnu) Proxy-Authorization: Basic Y3RzXDMxMzMwMDpzd2VldGZlbC4yOQ==
---请求结束---代理响应：[HTTP/1.1 200 Connection established Date: Wed, 27 Aug 2014 11:49:52 GMT Age: 0 Via: 1.0 xaahshshds
] 启动 SSL 握手。握手成功；连接的插座 3 到 SSL 处理 0x00000000016831c0 证书：主题： /emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=get.docker.io 发行人： /emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=mycompany 错误：无法验证 get.docker.io 颁发的证书
/emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=mycompany': Unable to locally verify the issuer's authority. To connect to get.docker.io insecurely, use--no-check-certificate'。关闭 3/SSL 0x00000000016831c0
请给我一些关于我应该如何处理这个问题的指导。
编辑：
我现在已禁用此 IP 段的代理，但我仍然收到相同的错误。
命令：wget -S -d -O - https://get.docker.io 现在得到以下输出：
Setting --output-document (outputdocument) to -
DEBUG output created by Wget 1.13.4 on linux-gnu.
URI encoding = `UTF-8'
--2014-09-04 11:26:12-- https://get.docker.io/
Resolving get.docker.io (get.docker.io)... 162.242.195.77
Caching get.docker.io => 162.242.195.77
Connecting to get.docker.io (get.docker.io)|162.242.195.77|:443... connected.
Created socket 3.
Releasing 0x00000000022d8fd0 (new refcount 1).
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x00000000022dabd0
certificate:
subject: /serialNumber=exkd9EjUozUulWIyUDurQPMEPBLSc2Bq/OU=GT98568428/OU=See www.rapidssl.com/resources/cps (c)13/OU=Domain Control Validated - RapidSSL(R)/CN=*.docker.io
issuer: /C=US/O=GeoTrust, Inc./CN=RapidSSL CA
X509 certificate successfully verified and matches host get.docker.io
---request begin---
GET / HTTP/1.1
User-Agent: Wget/1.13.4 (linux-gnu)
Accept: */*
Host: get.docker.io
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 503 Service Unavailable
Server: nginx/1.7.1
Date: Thu, 04 Sep 2014 06:03:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache
---response end---
HTTP/1.1 503 Service Unavailable
Server: nginx/1.7.1
Date: Thu, 04 Sep 2014 06:03:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache
Registered socket 3 for persistent reuse.
Skipping 108 bytes of body: [<html><body><h1>503 Service Unavailable</h1>
No server is available to handle this request.
</body></html>
] done.
2014-09-04 11:26:13 ERROR 503: Service Unavailable.
【问题讨论】：
-
好吧，
docker是对的——序列号不应该是负数。它违反了政策，软件通常会容忍它。您可以让您的 IT 人员生成新证书吗？这可能最容易绕过这个问题。