blocks|key|1386942|text|在码头注册中心，证书必须使用subjectAltName编译，如文档中所述。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1386943|您可以尝试创建这样的证书：|1386944|openssl+genrsa+-aes256+-out+ca-key.pem+4096
openssl+req+-new+-x509+-days+365+-key+ca-key.pem+-sha256+-out+ca.pem
openssl+genrsa+-out+server-key.pem+4096
openssl+req+-subj+"/CN=101.102.103.104"+-sha256+-new+-key+server-key.pem+-out+server.csr
echo+subjectAltName+=+DNS:101.102.103.104,IP:101.102.103.104,IP:127.0.0.1+>>+extfile.cnf
openssl+x509+-req+-days+365+-sha256+-in+server.csr+-CA+ca.pem+-CAkey+ca-key.pem+-CAcreateserial+-out+server-cert.pem+-extfile+extfile.cnf|code-block|syntax|javascript|1386945|然后，可以使用以下命令验证证书中是否存在subject+alternative+name+(SAN)：|1386946|openssl+x509+-in+server-cert.pem+-text+-noout|style|CODE|1386947|现在再试着拉。别忘了把新的证书交给/etc/docker/certs.d/101.102.103.104:5051/|1386948|如果在此之后您得到了一个新的错误x509:+certificate+signed+by+unknown+authority|1386949|在/etc/default/docker中，您需要指定码头选项：DOCKER_OPTS="--insecure-registry+101.102.103.104:5051"|1386950|然后重新启动守护进程(如果不允许用户启动码头服务，请添加sudo+)：|1386951|$+[sudo]+service+docker+restart|1386952|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.docker.com/engine/security/https/^0|W|2|0|0|0|0|0|0|19|0|H|15|0|G|19|0|1|J|W|1I|0|0|0|V|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@$A|19|B|1A|1|1B]]|C|$]]|$1|D|3|E|5|6|7|1C|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1D|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|1E|8|@]|9|@]|C|$]]|$1|M|3|N|5|6|7|1F|8|@$A|1G|B|1H|O|P]]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1I|8|@$A|1J|B|1K|O|P]]|9|@]|C|$]]|$1|S|3|T|5|6|7|1L|8|@$A|1M|B|1N|O|P]]|9|@]|C|$]]|$1|U|3|V|5|6|7|1O|8|@$A|1P|B|1Q|O|P]|$A|1R|B|1S|O|P]]|9|@]|C|$]]|$1|W|3|X|5|6|7|1T|8|@]|9|@]|C|$]]|$1|Y|3|Z|5|6|7|1U|8|@$A|1V|B|1W|O|P]]|9|@]|C|$]]|$1|10|3|-4|5|6|7|1X|8|@]|9|@]|C|$]]]|11|$12|$5|13|14|15|C|$16|17]]]]

On the Docker registry the certificate has to be compiled with the subjectAltName as described in the <a href="https://docs.docker.com/engine/security/https/" rel="nofollow noreferrer">documentation</a>:

You can try creating the certificate like this:

<pre><code>openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
openssl genrsa -out server-key.pem 4096
openssl req -subj "/CN=101.102.103.104" -sha256 -new -key server-key.pem -out server.csr
echo subjectAltName = DNS:101.102.103.104,IP:101.102.103.104,IP:127.0.0.1 &gt;&gt; extfile.cnf
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
</code></pre>

You can then verify whether the subject alternative name (SAN) is present in the certificate using the following command:

<code>openssl x509 -in server-cert.pem -text -noout</code>

Now try again to pull. Do not forget to put the new cert to <code>/etc/docker/certs.d/101.102.103.104:5051/</code> 
If after this you get a new error 
<code>x509: certificate signed by unknown authority</code> 
In <code>/etc/default/docker</code>, you need to specify the docker options:
<code>DOCKER_OPTS="--insecure-registry 101.102.103.104:5051"</code>

Then restart the daemon (add sudo if you user is not allowed to start a docker service):

<code>$ [sudo] service docker restart</code>

I have installed Nexus-3.15.2-01 on CentOS-7.6, Nginx reverse proxy and SSL self-signed certificate configured to access over Https. https access working fine over browser. 

Nexus Docker private repository https method activated.

From my docker host, when I tried to pull the docker images from my nexus private docker hub server, it failing with below.

<pre><code>docker pull 101.102.103.104:5051/docker-image-14:1
Error response from daemon: Get https:// 101.102.103.104:5051/v2/: x509: cannot validate certificate for 101.102.103.104 because it doesn't contain any IP SANs
</code></pre>

I have moved my nexus.crt file to docker host <code>/etc/docker/certs.d/101.102.103.104:5051/</code> location. Still not working.

Nexus private docker pull image failing with x509: cannot validate certificate error

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我已经在CentOS7.6、Nginx反向代理和SSL自签名证书上安装了Nexus-3.15.2-01，这些证书配置为通过Https访问。https访问可以在浏览器上正常工作。激活Nexus私有存储库https方法。从我的码头主机，当我试图从我的附件私人码头枢纽服务器的对接图像，它在下面失败。docker pull 1...

问Nexus专用码头拉出映像与x509失败:无法验证证书错误
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Nexus专用码头拉出映像与x509失败:无法验证证书错误EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Nexus专用码头拉出映像与x509失败:无法验证证书错误
EN