dockerfile中from命令无法拉取镜像而docker的pull命令能拉取镜像

问题现象：

docker pull images拉取镜像正常

dockerfile中的from命令拉取镜像就会报出证书错误。报错信息如下：

复制代码

[bjxtb@wj-kvm-test-jenkins-6-243 ceshi_dockerfile]$ docker build .
[+] Building 0.4s (3/3) FINISHED                                                                                                                                                                   docker:default
 => [internal] load build definition from Dockerfile                                                                                                                                                         0.0s
 => => transferring dockerfile: 273B                                                                                                                                                                         0.0s
 => ERROR [internal] load metadata for hub:10043/base_java/debian-jdk8-base:1.0.2                                                                                                            0.3s
 => [auth] base_java/debian-jdk8-base:pull token for hub:10043                                                                                                                               0.0s
------
 > [internal] load metadata for hub:10043/base_java/debian-jdk8-base:1.0.2:
------
Dockerfile:1
--------------------
   1 | >>> FROM hub:10043/base_java/debian-jdk8-base:1.0.2
   2 |     WORKDIR /hskj/app
   3 |     
--------------------
ERROR: failed to solve: hub:10043/base_java/debian-jdk8-base:1.0.2: failed to resolve source metadata for hub.:10043/base_java/debian-jdk8-base:1.0.2: failed to authorize: failed to fetch oauth token: Post "https://hub:10043/service/token": tls: failed to verify certificate: x509: certificate signed by unknown authority

尝试各种方法：

/etc/docker/daemon.json文件添加如下参数

insecure-registries

/etc/docker/certs.d/配置免密

两种往上常见方式都无果，最终找到一篇文章：

解决思路：把证书直接用openssl拉下来，然后加入到系统系统证书中，然后使用update-ca-certificates更新，最后重启docker服务，成功！！

方法1:

复制代码

$ echo -n | openssl s_client -showcerts -connect dseasb33srnrn.cloudfront.net:443 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /usr/local/share/ca-certificates/cloudfront.crt
$ update-ca-certificatesUpdating certificates in /etc/ssl/certs... 1 added, 0 removed; done.Running hooks in /etc/ca-certificates/update.d....Adding debian:cloudfront.pemdone.done.

方法2：

复制代码

$ echo -n | openssl s_client -showcerts -connect dseasb33srnrn.cloudfront.net:443 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >> /etc/ssl/certs/ca-certificates.crt

上面的方式之所以可以搞定大多数由于公司替换https证书造成的错误，是因为很多程序是使用系统默认的证书（路径）。

对于一些特殊的程序，比如python pip,不使用系统默认的证书，而是使用自己的路径，可以强制它使用*方式2*生成的证书。

参考连接：https://www.cnblogs.com/sting2me/p/5596222.html