title: Docker: private registry access
body: <p>I'm trying to push an image to my docker private repository:</p>
  
  <pre><code>docker pull busybox
  docker tag busybox living-registry.com:5000/busybox
  docker push living-registry.com:5000/busybox
  </code></pre>
  
  <p>Docker tells me:</p>
  
  <blockquote>
    <p>The push refers to a repository [living-registry.com:5000/busybox]
    Get <a href="https://living-registry.com:5000/v1/_ping" rel="nofollow">https://living-registry.com:5000/v1/_ping</a>: read tcp 195.83.122.16:39714->195.83.122.16:5000: read: connection reset by peer</p>
  </blockquote>
  
  <p>These commands are being performed on a CoreOS.</p>
  
  <p>In another machine, I've started my registry using this command:</p>
  
  <pre><code>docker run -d -p 5000:5000 --restart=always --name registry \
    -v /root/docker-registry/auth:/auth \
    -e "REGISTRY_AUTH=htpasswd" \
    -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
    -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
    -v /root/docker-registry/certs:/certs \
    -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
    -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
    -v /root/docker-registry/data:/var/lib/registry \
    registry:2
  </code></pre>
  
  <p>Everything seems to be right:</p>
  
  <pre><code># netstat -tupln | grep 5000
  tcp6       0      0 :::5000       :::*      LISTEN      3160/docker-proxy
  
  # docker ps
  CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                          PORTS                    NAMES
  27e79f6a504c        registry:2          "/bin/registry serve "   About an hour ago   Restarting (2) 36 minutes ago   0.0.0.0:5000-&gt;5000/tcp   registry
  </code></pre>
  
  <p>So, when I'm trying to log in:</p>
  
  <pre><code>[root@jenkins certs]# docker login living-registry.com:5000
  Username: xxxx
  Password: xxxx
  </code></pre>
  
  <blockquote>
    <p>Error response from daemon: Get <a href="https://living-registry.com:5000/v1/users/" rel="nofollow">https://living-registry.com:5000/v1/users/</a>: read tcp 195.83.122.16:39756->195.83.122.16:5000: read: connection reset by peer</p>
  </blockquote>
  
  <p>Any ideas?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I've already added the certificate (<code>ca.crt</code>) in <code>/etc/ssl/certs</code> and in <code>/etc/docker/certs.d/x.x.x.x:5000/</code>.</p>
  
  <p>From this CoreOS instance, I'm trying to perform that:</p>
  
  <p><code>
  $ docker login https://x.x.x.x:5000
  Username: xxx
  Password:
  Email: xxx@mail.com
  </code>
  And it tells me:</p>
  
  <blockquote>
    <p>Error response from daemon: invalid registry endpoint <a href="https://x.x.x.x:5000/v0/" rel="nofollow">https://x.x.x.x:5000/v0/</a>: unable to ping registry endpoint <a href="https://x.x.x.x:5000/v0/" rel="nofollow">https://x.x.x.x:5000/v0/</a>
    v2 ping attempt failed with error: Get <a href="https://x.x.x.x:5000/v2/" rel="nofollow">https://x.x.x.x:5000/v2/</a>: EOF
     v1 ping attempt failed with error: Get <a href="https://x.x.x.x:5000/v1/_ping" rel="nofollow">https://x.x.x.x:5000/v1/_ping</a>: EOF. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add <code>--insecure-registry x.x.x.x:5000</code> to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/x.x.x.x:5000/ca.crt</p>
  </blockquote>
  
  <p>I've also tried to get the connection directly with <code>openssl</code>:</p>
  
  <pre><code>openssl s_client -connect x.x.x.x:5000
  </code></pre>
  
  <p>The output is:</p>
  
  <pre><code>CONNECTED(00000003)
  140180300502672:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 0 bytes and written 308 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : 0000
      Session-ID:
      Session-ID-ctx:
      Master-Key:
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1467812448
      Timeout   : 300 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>