Configure Docker Registry Certificate

About this task

The local Docker registry provides secure HTTPS access using the registry API.

About this task

By default, a self-signed server certificate is generated at installation time for the registry API. For more secure access, an intermediate or Root CA-signed server certificate is strongly recommended.

To configure or update the HTTPS certificate for the local Docker registry, create a certificate named system-registry-local-certificate in the deployment namespace. The secretName attribute of this certificate’s spec must also be named system-registry-local-certificate.

See the example procedure below for creating the certificate for the local Docker registry. This example assumes you have configured a system-local-ca ClusterIssuer as described in Create a local CA Issuer.

Update the following fields:

  • The duration and renewBefore dates for the expiry and renewal times you desire. The system will automatically renew and re-install the certificate.

  • The subject fields to identify your particular system.

  • The ipAddresses with the OAM Floating IP Address and the MGMT Floating IP address for this system which MUST be specified for this certificate. Use the system addrpool-list command to get the OAM floating IP Address and MGMT floating IP Address for your system.

  • The dnsNames with registry.local, registry.central and any FQDN names configured for this system’s OAM Floating IP Address in an external DNS server.


  1. Create the Docker certificate yaml configuration file.

    ~(keystone_admin)]$ cat <<EOF > docker-certificate.yaml
    kind: Certificate
      name: system-registry-local-certificate
      namespace: deployment
      secretName: system-registry-local-certificate
        name: system-local-ca
        kind: ClusterIssuer
      duration: 2160h    # 90d
      renewBefore: 360h  # 15d
          - StarlingX-system-registry-local
        - <OAM_FLOATING_IP>
        - <MGMT_FLOATING_IP>
        - registry.local
        - registry.central
        - <external-FQDN-for-OAM-Floating-IP-Address, if applicable>
  2. Apply the configuration.

    ~(keystone_admin)]$ kubectl apply -f docker-certificate.yaml
  3. Verify the configuration.

    ~(keystone_admin)]$ kubectl get certificate system-registry-local-certificate –n deployment

    If configuration was successful, the certificate’s Ready status will be True.

  4. Update the platform’s trusted certificates (i.e. ssl_ca) with the Root CA associated with system-registry-local-certificate.

    See the example below where a Root CA system-local-ca was used to sign the system-registry-local-certificate, the ca.crt of the system-local-ca SECRET is extracted and added as a trusted CA for StarlingX (i.e. system certificate-install -m ssl_ca).

    ~(keystone_admin)]$ kubectl -n cert-manager get secret system-local-ca -o yaml | fgrep tls.crt | awk '{print $2}' | base64 --decode >> system-local-ca.pem
    ~(keystone_admin)]$ system certificate-install -m ssl_ca system-local-ca.pem


The Docker registry certificate installation is now complete, and Cert-Manager will handle the lifecycle management of the certificate.