title: X509 parsing error, 'negative serial number' while pulling repository
body: <p>Our server access internet through a proxy. When I try to run a pull command such as </p>
  
  <pre><code>sudo docker run -t -i ubuntu:14.04 /bin/bash
  </code></pre>
  
  <p>I get the below error:</p>
  
  <pre><code>Get https://index.docker.io/v1/repositories/ubuntu/images: tls: failed to parse
      certificate from server: x509: negative serial number
  </code></pre>
  
  <p>The wget command  <code>wget -S -d -O - https://get.docker.io</code> yields the below output:</p>
  
  <blockquote>
    <p>Setting --output-document (outputdocument) to - DEBUG output created
    by Wget 1.13.4 on linux-gnu.</p>
    
    <p>URI encoding = <code>UTF-8' URI encoding =</code>UTF-8'
    --2014-08-27 17:13:46--  <a href="https://get.docker.io/" rel="nofollow">https://get.docker.io/</a> Connecting to :... connected. Created socket 3. Releasing
    0x00000000016829f0 (new refcount 0). Deleting unused
    0x00000000016829f0.</p>
    
    <p>---request begin--- CONNECT get.docker.io:443 HTTP/1.1 User-Agent: Wget/1.13.4 (linux-gnu) Proxy-Authorization: Basic
    Y3RzXDMxMzMwMDpzd2VldGZlbC4yOQ==</p>
    
    <p>---request end--- proxy responded with: [HTTP/1.1 200 Connection established Date: Wed, 27 Aug 2014 11:49:52 GMT Age: 0 Via: 1.0
    xaahshshhds</p>
    
    <p>] Initiating SSL handshake. Handshake successful; connected socket 3
    to SSL handle 0x00000000016831c0 certificate:   subject:
    /emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=get.docker.io
    issuer: 
    /emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=mycompany
    ERROR: cannot verify get.docker.io's certificate, issued by
    <code>/emailAddress=aaa@bbbb.com/C=yy/ST=aa/L=xx/O=yy/OU=mycompany/CN=mycompany':
    Unable to locally verify the issuer's authority. To connect to
    get.docker.io insecurely, use</code>--no-check-certificate'. Closed 3/SSL
    0x00000000016831c0</p>
  </blockquote>
  
  <p>Please give me some directions on how I should go about this issue.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I ve now disabled the proxy for this IP segment but I still get the same error. 
  The command: <code>wget -S -d -O - https://get.docker.io</code> gets the below output now:</p>
  
  <pre><code>Setting --output-document (outputdocument) to -
  DEBUG output created by Wget 1.13.4 on linux-gnu.
  
  URI encoding = `UTF-8'
  --2014-09-04 11:26:12--  https://get.docker.io/
  Resolving get.docker.io (get.docker.io)... 162.242.195.77
  Caching get.docker.io =&gt; 162.242.195.77
  Connecting to get.docker.io (get.docker.io)|162.242.195.77|:443... connected.
  Created socket 3.
  Releasing 0x00000000022d8fd0 (new refcount 1).
  Initiating SSL handshake.
  Handshake successful; connected socket 3 to SSL handle 0x00000000022dabd0
  certificate:
    subject: /serialNumber=exkd9EjUozUulWIyUDurQPMEPBLSc2Bq/OU=GT98568428/OU=See www.rapidssl.com/resources/cps (c)13/OU=Domain Control Validated - RapidSSL(R)/CN=*.docker.io
    issuer:  /C=US/O=GeoTrust, Inc./CN=RapidSSL CA
  X509 certificate successfully verified and matches host get.docker.io
  
  ---request begin---
  GET / HTTP/1.1
  User-Agent: Wget/1.13.4 (linux-gnu)
  Accept: */*
  Host: get.docker.io
  Connection: Keep-Alive
  
  ---request end---
  HTTP request sent, awaiting response...
  ---response begin---
  HTTP/1.1 503 Service Unavailable
  Server: nginx/1.7.1
  Date: Thu, 04 Sep 2014 06:03:28 GMT
  Content-Type: text/html
  Transfer-Encoding: chunked
  Connection: keep-alive
  Cache-Control: no-cache
  
  ---response end---
  
    HTTP/1.1 503 Service Unavailable
    Server: nginx/1.7.1
    Date: Thu, 04 Sep 2014 06:03:28 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache
  Registered socket 3 for persistent reuse.
  Skipping 108 bytes of body: [&lt;html&gt;&lt;body&gt;&lt;h1&gt;503 Service Unavailable&lt;/h1&gt;
  No server is available to handle this request.
  &lt;/body&gt;&lt;/html&gt;
  
  ] done.
  2014-09-04 11:26:13 ERROR 503: Service Unavailable.
  </code></pre>