Private Docker Registry - what is the correct rootcertbundle? - docker

Question

I'm trying to setup a private docker registry that is secured via the token method. The authentication server it is hitting is a private authentication server. I'm getting this error when trying to login: level=info msg="unable to get token signing key"
I am seeing a JWT token being generated and returned from the authentication server.
Docker Registry Config:
version: 0.1
log:
accesslog:
disabled: false
level: info
fields:
service: registry
environment: development
storage:
delete:
enabled: true
cache:
blobdescriptor: inmemory
filesystem:
rootdirectory: /var/lib/registry
http:
host: https://127.0.0.1:5000
addr: 0.0.0.0:5000
debug:
addr: 0.0.0.0:5001
secret: notasecret123
tls:
certificate: /certs/registry.crt
key: /certs/registry.key
headers:
X-Content-Type-Options: [nosniff]
auth:
token:
realm: https://localhost:3443/dockerauth
service: https://localhost:5000
issuer: https://localhost:3443
rootcertbundle: /certs/registry.crt
health:
storagedriver:
enabled: true
interval: 10s
threshold: 3
JWT signing:
var i = 'https://localhost:3443';
var s = 'registry';
var a = 'https://localhost:5000';
var signOptions = {
issuer: i,
subject: s,
audience: a,
expiresIn: "1h",
algorithm: "RS256"
};
var registryKey = fs.readFileSync('/app/bin/keys/registry.key');
var token = jwt.sign(payload, registryKey, signOptions);
I've tried creating a RSA public/private key to sign the JWT token and then set the rootcertbundle to the public RSA key, but I got an error indicating that I needed a PEM cert. So I created a PEM cert and got the same error I started out with.