nerdexam
Docker

DCA · Question #162

You are pulling images from a Docker Trusted Registry installation configured to use self-signed certificates, and this error appears: 'x509: certificate signed by unknown authority'. You already…

The correct answer is D. Pass --insecure-registry to the Docker client. E. Place the certificate in '/etc/docker/certs.d/dtr.example com/ca.crt' on all cluster nodes. To trust a self-signed certificate for Docker Trusted Registry, either configure the Docker daemon to treat the registry as insecure or explicitly place the CA certificate in the Docker daemon's trust store for that registry.

Submitted by klara.se· Apr 18, 2026Image Creation, Management, and Registry

Question

You are pulling images from a Docker Trusted Registry installation configured to use self-signed certificates, and this error appears:

'x509: certificate signed by unknown authority'. You already downloaded the Docker Trusted Registry certificate authority certificate from https://dtr.example.com/ca. How do you trust it? (Select two.)

Options

  • APlace the certificate in '/etc/docker/dtr/dtr.example.com.crt' and restart the Docker daemon on all
  • BPlace the certificate in your OS certificate path, trust the certificate system-wide, and restart the
  • CPass '-trust-certificate ca.crt' to the Docker client.
  • DPass --insecure-registry to the Docker client.
  • EPlace the certificate in '/etc/docker/certs.d/dtr.example com/ca.crt' on all cluster nodes.

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    15% (3)
  • D
    75% (15)

Why each option

To trust a self-signed certificate for Docker Trusted Registry, either configure the Docker daemon to treat the registry as insecure or explicitly place the CA certificate in the Docker daemon's trust store for that registry.

APlace the certificate in '/etc/docker/dtr/dtr.example.com.crt' and restart the Docker daemon on all

The path `/etc/docker/dtr/dtr.example.com.crt` is not the standard or correct location for Docker daemon to trust registry CA certificates.

BPlace the certificate in your OS certificate path, trust the certificate system-wide, and restart the

While trusting a certificate system-wide *can* work, the more direct and explicit Docker daemon configuration involves placing the certificate in `/etc/docker/certs.d/`.

CPass '-trust-certificate ca.crt' to the Docker client.

There is no standard `docker` client flag like `-trust-certificate` for directly trusting a CA certificate for a pull operation; trust is configured at the daemon level or by using `--insecure-registry`.

DPass --insecure-registry to the Docker client.Correct

The `--insecure-registry` flag tells the Docker daemon to allow communication with a specific registry even if its certificate is untrusted or self-signed, bypassing certificate validation for that registry. This is often used for testing or development environments.

EPlace the certificate in '/etc/docker/certs.d/dtr.example com/ca.crt' on all cluster nodes.Correct

To properly trust a self-signed certificate for a Docker registry, the CA certificate file must be placed in a directory structured as `/etc/docker/certs.d/<registry-hostname>:<port>/ca.crt` on the Docker client/daemon host, followed by a Docker daemon restart. This instructs the Docker daemon to trust that specific CA for connections to the named registry.

Concept tested: Docker registry self-signed certificate trust

Source: https://docs.docker.com/engine/security/certificates/

Topics

#Docker Registry#Certificates#Daemon Configuration#Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DCA Practice