1.registry服务端证书生成：
[root@docker2 ~]# mkdir registry_certs root@docker2 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout registry_certs/domain.key -x509 -days 365 -out registry_certs/domain.crt Generating a 4096 bit RSA private key ..........................................................................................................................++ ..............++ writing new private key to 'registry_certs/domain.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]: State or Province Name (full name) []: Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:docker2 注：镜像寄存服务器主机名（也可使用IP地址） Email Address []: [root@docker2 ~]# ls registry_certs/ domain.crt domain.key
使用IP地址作为Common Name：
IP地址设置Subject Alternative Name，编辑openssl.cnf,在[v3_ca]下面添加：subjectAltName = IP:IP地址，common name为ip地址不便的地方是当镜像寄存服务器ip地址变化时得修改镜像标签。
[root@docker2 ~]# vim /etc/pki/tls/openssl.cnf 在[ v3_ca ] 添加下行： subjectAltName = IP:192.168.88.130
2.将证书颁发给访问服务器
[root@pysaber ~]# mkdir -p /etc/docker/certs.d/192.168.88.130:5000 [root@pysaber ~]# scp root@192.168.88.130:/root/registry_certs/domain.crt /etc/docker/certs.d/192.168.88.130:5000/ca.crt
3.访问服务器将生成的私有证书追加到系统的证书管理文件，docker服务重新启动
[root@pysaber ~]# cat /etc/docker/certs.d/192.168.88.130:5000/ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
4.启动镜像寄存服务器
[root@docker2 ~]# docker run -d -p 5000:5000 -v $(pwd)/registry_certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key --restart=always --name registry registry:2.2 44b26b2d474793559e9d71a499be23fdddfdd3d7f44d3db896809e102e412678
5.镜像上传
[root@pysaber ~]# docker push docker2:5000/redis:latest The push refers to a repository [docker2:5000/redis] 0ea23dbb18ab: Pushed 036b23f466ca: Pushed 23cfd5584151: Pushed 0a5fa8924bd6: Pushed 4f442ee57ce8: Pushed 6744ca1b1190: Pushed latest: digest: sha256:5266020ee7b599a5f7dd09152fc1c5840b71e2febe0c6795186854cc36dc6e30 size: 11033