Can't access docker registry on CentOS 7.1, "connection refused"

Hi, I have docker installed

[root@localhost ~]# docker --version
Docker version 1.13.1, build 092cba3

I’m operating behind a proxy server, which I have configured:

[root@localhost ~]# systemctl show --property=Environment docker
Environment=HTTP_PROXY=http://proxy.redacted.com:8080

I’m able to curl to the registry:
[root@localhost ~]# curl https://registry-1.docker.io/v2/ -vvv
* About to connect() to proxy proxy.redacted.com port 8080 (#0)
* Trying 192.168.2.12…
* Connected to proxy.redacted.com (192.168.2.12) port 8080 (#0)
* Establish HTTP proxy tunnel to registry-1.docker.io:443
> CONNECT registry-1.docker.io:443 HTTP/1.1
> Host: registry-1.docker.io:443
> User-Agent: curl/7.29.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=*.docker.io,OU=Domain Control Validated - RapidSSL(R),OU=See Upgrade your TLS/SSL & Wildcard Certificates to GeoTrust | RapidSSL (c)15,OU=GT98568428
* start date: Mar 19 17:34:32 2015 GMT
* expire date: Apr 21 01:51:52 2018 GMT
* common name: *.docker.io
* issuer: CN=RapidSSL SHA256 CA - G3,O=GeoTrust Inc.,C=US
> GET /v2/ HTTP/1.1
> User-Agent: curl/7.29.0
> Host: registry-1.docker.io
> Accept: /
>
< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm=“https://auth.docker.io/token",service="registry.docker.io
< Date: Mon, 27 Feb 2017 14:36:51 GMT
< Content-Length: 87
< Strict-Transport-Security: max-age=31536000
<
{“errors”:[{“code”:“UNAUTHORIZED”,“message”:“authentication required”,“detail”:null}]}
* Connection #0 to host proxy.redacted.com left intact

However, docker pull will not work:
[root@localhost ~]# docker pull hello-world
Using default tag: latest
Error response from daemon: Get https://registry-1.docker.io/v2/: dial tcp 52.72.139.208:443: getsockopt: connection refused

Any advice on what to do? I’m stumped at this point.