1

I'm currently implementing a private Docker Registry server with nginx configured to forward https traffic securely to the running Docker Registry (i.e. docker-compose) instance on a private network (with DNS, DHCP configured).

I have the entire setup working as expected, but had to create self-signed certificates as I'm not permitted to use "Let's Encrypt" (hard requirement). I've deployed the .crt file to /usr/local/share/ca-certificates on all the Ubuntu hosts on my network, and updated the certificate store (i.e. via sudo update-ca-certificates -f).

However, even though the certificate is "trusted" (from the step above), the certificate is still registered as "self-signed", and the only way I can get Docker Registry working fully is by creating a file, /etc/docker/daemon.json, with the following contents (assuming my Docker Registry instance is running on the registry host on my lan domain):

{
  "insecure-registries" : [ "registry.lan:5000" ]
}

This causes some functionality to break (i.e. there are some plugins that won't work if "insecure registries" are enabled).

Question

How can I configure my private network (i.e. assuming it isn't even connected to the internet most of the time) so that all machines on the network "fully trust" the certificate (i.e. so the cert is "publicly trusted" amongst hosts on the local network)? i.e. what command can I run or config file can I tweak?

This seems like a possible solution: create a CA plus server key on my private network.

Thank you.

Community
  • 1
Rolf
  • 11
  • 1

1 Answers1

1

Use a certificate authority you trust to sign x509 certificates.

Put the resulting cert and its key on the web server where you terminate TLS.

Using CA signed certs does not imply use of Let's Encrypt; neither does the inverse. Use of other PKI is possible, either run by your organization (a bit of a project to do properly) or not.

John Mahowald
  • 30,009
  • 1
  • 17
  • 32