kubkubernes/openshift记： docker pull 私有registry，报x509: certificate signed by unknown authority错误的解决办法

[root@localhost ~]# docker pull docker-registry-default.apps.oc.local/nxe-sanbox/nginx-example
Using default tag: latest
Error response from daemon: Get https://docker-registry-default.apps.oc.local/v2/: x509: certificate signed by unknown authority

[root@localhost ~]# curl https://ose3-master1.oc.local:8443                                  
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
 
 

 解决办法
把镜像仓库的ca证书放到需要运行docker pull的机器
k8s的ca根证书一般/etc/kubernetes/ca.pem
openshift的是 /etc/origin/master/ca.crt 

下载下来，拷贝到
/etc/pki/ca-trust/source/anchors/openshift.crt
运行命令，更新信任ca
update-ca-trust extract

重启docker，使docker对新的ca可见
systemctl restart docker