Failed to verify certificate: x509

Docker Engine General
1

I read a few forums that unfortunately didn’t solve my problem.
Using wsl ubuntu on Windows 11

I installed docker using the following:
sudo apt install docker.io

I followed the steps in the following forum link.
Tls: failed to verify certificate: x509 - Docker Hub - Docker Community Forums](Tls: failed to verify certificate: x509)

error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate signed by unknown authority

However I don’t know how he was able to see a Zscalar error when I did the same steps:
curl -vvvv https://registry-1.docker.io
openssl s_client -showcerts -connect registry-1.docker.io:443 </dev/null

Got almost the exact same result and I don’t see a company policy error.
Any advice, as I am unable to move forwards. Is there somewhere else I should be looking?

2

Please share the output of the commands you used to test, as it helps us to get a more precise understanding.

This does not install docker-ce from docker’s repos (what this forum supports), it installs the docker.io package from the distro repos (what the maintainer of the package and/or the disto community supports).

3

If your network has a proxy with a whitelist it probably needs an update.

4

Sorry for the late reply and thanks for letting me know. I purged the docker.io and install the communty engine based on the instructions in:
Ubuntu | Docker Docs

Still recieving the same error for :
sudo docker run hello-world

[ERROR]: “error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate signed by unknown authority”

Due to not knowing whether or not sharing the output information could pose a security risk to the company I work for, is it possible to describe what I should be looking for?

5

Please share the output of this Linux command:

openssl s_client -showcerts -connect registry-1.docker.io:443 </dev/null | head -n 1
6 
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, CN = Amazon RSA 2048 M02
verify return:1
depth=0 CN = *.docker.com
verify return:1
DONE
CONNECTED(00000003)
7

Did you run the command on your host that has the problems?

Its interesting that the chain can be verified with the openssl command, but can’t in docker.

8

Yep, the command was ran in the wsl ubuntu.

9

Update: I check in with my security team, docker.io and related registries are blocked from our end.
The mystery is resolved.
Sincerely thanks for helping me.

10

That’s probably part of their supply chain security strategy. But in that case I would expect them to provide a curated pull through mirror.

1 Like