title: docker login fails -> x509: certificate signed by unknown authority .. "crypto/rsa: verification error"
body: <p>I have created a private docker registry which is fronted by NGINX. NGINX is where the ssl terminates. </p>
  
  <p><strong>I am obfuscating my domain by using my-domain.com for the purpose of this question.</strong></p>
  
  <p>I am using OSX 10.10.3 which has boot2docker installed. But it should be noted that the workflow of Vagrant + CoreOS + Docker shouldn't involve boot2docker since I am having issues within the VM(CoreOS) and not the Host(OSX).</p>
  
  <p>I am using Vagrant to spin up a local CoreOS VM from this <a href="http://alpha.release.core-os.net/amd64-usr/681.0.0/coreos_production_vagrant.box" rel="nofollow">box</a>. I then ssh into an instance of that VM and attempt to issue the following command</p>
  
  <pre><code>$ docker login docker.my-domain.com
  </code></pre>
  
  <p>I am then prompted for my username, password, email as expected; and I supply my details.</p>
  
  <p>Note: I am able to issue the above command in the Host OS (OSX) as expected and able to successfully login (generates the ~/.dockercfg file).</p>
  
  <p>I get the following error:</p>
  
  <pre><code>FATA[0008] Error response from daemon: v1 ping attempt failed with error: Get https://docker.my-domain.com/v1/_ping: 
  x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to 
  verify candidate authority certificate "*.my-domain.com"). If this private registry supports only HTTP or HTTPS 
  with an unknown CA certificate, please add `--insecure-registry docker.my-domain.com` to the daemon's 
  arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; 
  simply place the CA certificate at /etc/docker/certs.d/docker.my-domain.com/ca.crt
  </code></pre>
  
  <p>I have copied over my ca.crt from my self signing. I can confirm that CoreOS is able to connect properly to my server over SSL. I ran this command</p>
  
  <pre><code>openssl s_client -CAfile /etc/docker/certs.d/docker.my-domain.com/ca.crt -connect docker.my-domain.com:443
  </code></pre>
  
  <p>And I get the expected 'Verify return code: 0 (ok)'. This leads me to believe its docker that seems to be having a problem. </p>
  
  <pre><code>$ docker version (from within CoreOS VM)
  Client version: 1.6.1-rc2
  Client API version: 1.18
  Go version (client): go1.4.2
  Git commit (client): 17f157d-dirty
  OS/Arch (client): linux/amd64
  Server version: 1.6.1-rc2
  Server API version: 1.18
  Go version (server): go1.4.2
  Git commit (server): 17f157d-dirty
  OS/Arch (server): linux/amd64
  </code></pre>
  
  <p>After all this, I am not sure what I need to try next. Any and all help is appreciated!</p>