@balonik I downloaded and installed gitlab.com chain certificate
ls /etc/docker/certs.d/*/*
/etc/docker/certs.d/registry.gitlab.com/gitlab-ca.crt
I use curl also and it seems working
curl -v https://registry.gitlab.com
* Trying 104.18.26.123:443...
* TCP_NODELAY set
* Connected to registry.gitlab.com (104.18.26.123) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=gitlab.com
* start date: Jul 4 00:00:00 2022 GMT
* expire date: Oct 2 23:59:59 2022 GMT
* subjectAltName: host "registry.gitlab.com" matched cert's "registry.gitlab.com"
* issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare Inc ECC CA-3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55b8319ae2f0)
> GET / HTTP/2
> Host: registry.gitlab.com
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 256)!
< HTTP/2 200
< date: Wed, 20 Jul 2022 09:04:54 GMT
< content-length: 0
< cache-control: no-cache
< cf-cache-status: DYNAMIC
< expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hZsr2kP5Ds0EqPvFjYfQ4mfvs6QeRAgU%2F8aDwYY8gADk5kYQX9iH7zc7nlT8dNk65XjUn3BF2DVIGgLdznSsr%2BlT1xRTFnsNUCpwj%2FifCyxFZ7j7b55VUT7v6jbw%2Bcx%2FNAPTyOQ%3D"}],"group":"cf-nel","max_age":604800}
< nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
< strict-transport-security: max-age=31536000
< x-content-type-options: nosniff
< server: cloudflare
< cf-ray: 72da88349f550fd6-MRS
<
* Connection #0 to host registry.gitlab.com left intact
openssl s_client -servername registry.gitlab.com -connect registry.gitlab.com:443 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify return:1
depth=1 C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = gitlab.com
verify return:1
---
Certificate chain
0 s:C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = gitlab.com
i:C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
1 s:C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
i:C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFgzCCBSigAwIBAgIQBiPZw4be7paOmVGMBVHSLDAKBggqhkjOPQQDAjBKMQsw
CQYDVQQGEwJVUzEZMBcGA1UEChMQQ2xvdWRmbGFyZSwgSW5jLjEgMB4GA1UEAxMX
Q2xvdWRmbGFyZSBJbmMgRUNDIENBLTMwHhcNMjIwNzA0MDAwMDAwWhcNMjIxMDAy
MjM1OTU5WjBqMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQG
A1UEBxMNU2FuIEZyYW5jaXNjbzEZMBcGA1UEChMQQ2xvdWRmbGFyZSwgSW5jLjET
MBEGA1UEAxMKZ2l0bGFiLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABACu
ir0FpY/Td6QwLGHdBMssRJ9jEvqFqYj2y6K9ZQkiKbgzITxLPzUX5it8/ctNGiqn
+KOhQQefGKkRWYTzs5qjggPOMIIDyjAfBgNVHSMEGDAWgBSlzjfq67B1DpRniLRF
+tkkEIeWHzAdBgNVHQ4EFgQUp7B0Ubbe4FBSgpW+ucHTDarKhd4wgZQGA1UdEQSB
jDCBiYITcGFja2FnZXMuZ2l0bGFiLmNvbYIUY3VzdG9tZXJzLmdpdGxhYi5jb22C
CmdpdGxhYi5jb22CD2NoZWYuZ2l0bGFiLmNvbYIaZW1haWwuY3VzdG9tZXJzLmdp
dGxhYi5jb22CDmthcy5naXRsYWIuY29tghNyZWdpc3RyeS5naXRsYWIuY29tMA4G
A1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwewYD
VR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0Nsb3VkZmxh
cmVJbmNFQ0NDQS0zLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29t
L0Nsb3VkZmxhcmVJbmNFQ0NDQS0zLmNybDA+BgNVHSAENzA1MDMGBmeBDAECAjAp
MCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwdgYIKwYB
BQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20w
QAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9DbG91ZGZs
YXJlSW5jRUNDQ0EtMy5jcnQwDAYDVR0TAQH/BAIwADCCAX0GCisGAQQB1nkCBAIE
ggFtBIIBaQFnAHUAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAGB
xronxwAABAMARjBEAiA5IrJ05KRTZhpfPx4F0q+4fPYuXsURNIwl2+IDIXGfPgIg
GNMXcN5Ls2LPn5I8FJQ5PRzG+N/ipXIKym3BaHLNnP8AdgBByMqx3yJGShDGoToJ
QodeTjGLGwPr60vHaPCQYpYG9gAAAYHGuigJAAAEAwBHMEUCIE2XyQm+tVEVrmPk
qOTjT4LZR1cjzflhSWd6Gm9ydHG6AiEArEldk9K6kKLCLr1TsniI5FbyDoG86s83
+O1XPL+5swkAdgDfpV6raIJPH2yt7rhfTj5a6s2iEqRqXo47EsAgRFwqcwAAAYHG
uifLAAAEAwBHMEUCIAtAsPWw7ExMrIDeYiFYLuckjrqyTl4aRdVf3EdmgXFiAiEA
gMfVbiysb2r+G6pqUIm3IKZf1qzUCMgcQE0QDxd02mgwCgYIKoZIzj0EAwIDSQAw
RgIhAJq7U7Fasv+fIk/j1dlplJxovxE3YQTThZ/WnGmylkt/AiEAmLbVsjNPtKZW
sSwAYSAKFTsYqEWJLHbP9zi2dCvHtH4=
-----END CERTIFICATE-----
subject=C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = gitlab.com
issuer=C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2707 bytes and written 391 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 0D1330D2127464DA0ABC5784FF68ED9B0C22FDF59A260F5E5EF4CAFB455B68A8
Session-ID-ctx:
Resumption PSK: 81D999F3AE40AB60ECC2C43D7A189604ED7694221C2511FC34D07A94A8B4A235AE65AC1226C185B4C7AEFD3EA3F66824
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 64800 (seconds)
TLS session ticket:
0000 - 74 65 3b b4 8f 26 af 96-93 91 17 b6 78 70 14 40 te;..&......xp.@
0010 - 84 c5 59 fe ad 46 19 b6-00 68 7b 05 29 54 03 52 ..Y..F...h{.)T.R
0020 - be 21 89 08 85 61 7b 3a-67 20 43 89 b0 c0 2b 60 .!...a{:g C...+`
0030 - 90 10 05 4b 91 aa 09 62-4e 45 2e ed 09 7a 29 ae ...K...bNE...z).
0040 - 69 8c 93 5d 5b 32 fd e5-9b e9 1e 55 5d e8 8f 96 i..][2.....U]...
0050 - 14 07 7e 8b c7 74 a0 bb-28 f7 9f c1 00 43 0e a1 ..~..t..(....C..
0060 - f5 70 17 ba c3 8e c5 40-8f 33 17 97 20 d3 4b 77 .p.....@.3.. .Kw
0070 - ab 54 97 69 f4 96 be 5d-3a de 6f f3 a9 2c 85 a4 .T.i...]:.o..,..
0080 - d1 c7 9a f6 25 3e 35 29-49 b6 eb a9 6c 96 31 00 ....%>5)I...l.1.
0090 - f7 99 22 eb 79 3f d6 5c-36 a5 28 20 fb 85 7c 2c ..".y?.\6.( ..|,
00a0 - 1d 08 f7 f3 b8 ab 84 6e-5e 10 e6 0f bf db 65 60 .......n^.....e`
00b0 - 01 85 de 1f c3 6b 0d d9-03 cf f8 28 d5 24 ff 3c .....k.....(.$.<
Start Time: 1658308024
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: ED6E4AE2C0EFF15E2BF263791BDACBC36798561047237CCF96AAC540318F7C37
Session-ID-ctx:
Resumption PSK: 468AC38420A667AE674367C60C5DACAD626F5B963C2ED57E6379F5F945F02E01AD7206530F555331AE59BDFEE6C4C887
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 64800 (seconds)
TLS session ticket:
0000 - 74 65 3b b4 8f 26 af 96-93 91 17 b6 78 70 14 40 te;..&......xp.@
0010 - 48 1e 53 2f e8 29 2e 4d-74 ba d0 a4 af 0c 5f 2b H.S/.).Mt....._+
0020 - b1 8d 53 cd de 1a 60 27-b0 ad fa 14 72 1a 0b da ..S...`'....r...
0030 - a7 2e ed 51 44 0f 8c 16-89 fa 3e 1f 70 b1 70 0d ...QD.....>.p.p.
0040 - 21 d9 42 57 64 2f 54 5c-0a 11 43 ea c0 b7 62 ef !.BWd/T\..C...b.
0050 - 93 70 ec 49 89 54 a3 4c-d8 f9 7c 15 f5 2d 3b e2 .p.I.T.L..|..-;.
0060 - e4 30 3a ce 3e e1 3a c5-cf 57 5f d4 07 ad d6 95 .0:.>.:..W_.....
0070 - a3 54 7b d2 88 e4 e8 f5-ef 3a 00 a9 50 73 5d b3 .T{......:..Ps].
0080 - e8 5d ab e7 44 99 28 29-7c 36 c8 44 b5 22 aa 47 .]..D.()|6.D.".G
0090 - 27 1b 9b 81 a5 ca a6 cf-2a 77 2b 8e e4 5b dc 65 '.......*w+..[.e
00a0 - 0a 24 9a 5c 07 c5 04 70-9c 08 6b 59 75 99 70 53 .$.\...p..kYu.pS
00b0 - fb b8 37 10 ef 11 c2 52-94 74 4f 63 9e ce 87 6a ..7....R.tOc...j
Start Time: 1658308024
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
closed
