title: Docker/GitLab authentication for docker registry returns 401 error
body: <p>I'm trying to configure my docker registry using auth of gitlab (docker).</p>
  
  <p>Doing <code>docker login registry.website.com</code> gives me a <strong>401 Unauthorized</strong> error:</p>
  
  <pre><code>Error response from daemon: login attempt to https://registry.website.com/v2/ failed with status: 401 Unauthorized
  </code></pre>
  
  <p>In the docker logs I find</p>
  
  <pre><code>{ "level":"info","msg":"token signed by untrusted key with ID: \"IWNY:KT2H:YUN5:STQP:22LM:YNIU:RT4T:AZO7:TBVL:ZQ3I:Z4JZ:LA3T\"","time":"2018-12-17T23:36:03.538232467Z" }
  { [...] "level":"warning","msg":"error authorizing context: invalid token","service":"registry","source":"registry","time":"2018-12-17T23:36:03.53860308Z","version":"v2.6.2" }
  </code></pre>
  
  <p>My keys are generated by doing</p>
  
  <pre><code>$ sudo openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout registry-auth.key -out registry-auth.crt
  $ sudo chmod 400 registry-auth.key
  </code></pre>
  
  <p>In my debugging attempt I do get different sha256 digest:</p>
  
  <pre><code>459b854f47c51bd94e0fd696cc35148cf93065df986abcc368cf13958373d298
  459b854f47c51bd94e0fd696cc35148cf93065df986abcc368cf13958373
  </code></pre>
  
  <p>As @VDR has shown this is ok, as the first 30 characters are used. So with that there should not be a problem with the keys. But why do I get the 401 error?</p>
  
  <p>This is how I configured gitlab and the registry:</p>
  
  <p>The configuration of docker gitlab (gitlab.rb) uses the key by</p>
  
  <pre><code>gitlab_rails['registry_key_path'] = "/certs/registry-auth.key"
  </code></pre>
  
  <p>Config of registry has</p>
  
  <pre><code>auth.token.rootcertbundle: /root/certs/registry-auth.crt
  </code></pre>
  
  <p><em>nginx-proxy/vhost.d/docker-registry.conf</em></p>
  
  <pre><code>proxy_pass                          http://registry.website.com;
  proxy_set_header  Host              $http_host;   # required for docker client's sake
  proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
  proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header  X-Forwarded-Proto $scheme;
  proxy_read_timeout                  900;
  </code></pre>
  
  <p>I don't see what I'm missing here...</p>