crypto/x509/verify.go
// UnknownAuthorityError results when the certificate issuer is unknown
type UnknownAuthorityError struct {
    cert *Certificate
    // hintErr contains an error that may be helpful in determining why an
    // authority wasn't found.
    hintErr error
    // hintCert contains a possible authority certificate that was rejected
    // because of the error in hintErr.
    hintCert *Certificate
}

func (e UnknownAuthorityError) Error() string {
    s := "x509: certificate signed by unknown authority"
    if e.hintErr != nil {
        certName := e.hintCert.Subject.CommonName
        if len(certName) == 0 {
            if len(e.hintCert.Subject.Organization) > 0 {
                certName = e.hintCert.Subject.Organization[0]
            }
            certName = "serial:" + e.hintCert.SerialNumber.String()
        }
        s += fmt.Sprintf(" (possibly because of %q while trying to verify candidate authority certificate %q)", e.hintErr, certName)
    }
    return s
}

crypto/x509/root_unix.go
// Possible certificate files; stop after finding one.
var certFiles = []string{
    "/etc/ssl/certs/ca-certificates.crt",     // Debian/Ubuntu/Gentoo etc.
    "/etc/pki/tls/certs/ca-bundle.crt",       // Fedora/RHEL
    "/etc/ssl/ca-bundle.pem",                 // OpenSUSE
    "/etc/ssl/cert.pem",                      // OpenBSD
    "/usr/local/share/certs/ca-root-nss.crt", // FreeBSD/DragonFly
}

func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) {
    return nil, nil
}

func initSystemRoots() {
    roots := NewCertPool()
    for _, file := range certFiles {
        data, err := ioutil.ReadFile(file)
        if err == nil {
            roots.AppendCertsFromPEM(data)
            systemRoots = roots
            return
        }
    }

    // All of the files failed to load. systemRoots will be nil which will
    // trigger a specific error at verification time.
}

crypto/x509/root.go
func systemRootsPool() *CertPool {
    once.Do(initSystemRoots)
    return systemRoots
}

func NewEndpoint(hostname string, insecureRegistries []string) (*Endpoint, error) {
    endpoint, err := newEndpoint(hostname, insecureRegistries)
    if err != nil {
        return nil, err
    }

    // Try HTTPS ping to registry
    endpoint.URL.Scheme = "https"
    if _, err := endpoint.Ping(); err != nil {
…


func (e Endpoint) Ping() (RegistryInfo, error) {
    if e.String() == IndexServerAddress() {
        // Skip the check, we now this one is valid
        // (and we never want to fallback to http in case of error)
        return RegistryInfo{Standalone: false}, nil
    }

    req, err := http.NewRequest("GET", e.String()+"_ping", nil)
    if err != nil {
        return RegistryInfo{Standalone: false}, err
    }

    resp, _, err := doRequest(req, nil, ConnectTimeout, e.secure)
    if err != nil {
        return RegistryInfo{Standalone: false}, err
    }

func doRequest(req *http.Request, jar http.CookieJar, timeout TimeoutType, secure bool) (*http.Response, *http.Client, error) {
    var (
        pool  *x509.CertPool
        certs []*tls.Certificate
    )

    if secure && req.URL.Scheme == "https" {
        hasFile := func(files []os.FileInfo, name string) bool {
            for _, f := range files {
                if f.Name() == name {
                    return true
                }
            }
            return false
        }

        hostDir := path.Join("/etc/docker/certs.d", req.URL.Host)
        log.Debugf("hostDir: %s", hostDir)
        fs, err := ioutil.ReadDir(hostDir)
        if err != nil && !os.IsNotExist(err) {
            return nil, nil, err
        }

        for _, f := range fs {
            if strings.HasSuffix(f.Name(), ".crt") {
                if pool == nil {
                    pool = x509.NewCertPool()
                }
                log.Debugf("crt: %s", hostDir+"/"+f.Name())
                data, err := ioutil.ReadFile(path.Join(hostDir, f.Name()))
                if err != nil {
                    return nil, nil, err
                }
                pool.AppendCertsFromPEM(data)
            }
            if strings.HasSuffix(f.Name(), ".cert") {
                certName := f.Name()
                keyName := certName[:len(certName)-5] + ".key"
                log.Debugf("cert: %s", hostDir+"/"+f.Name())
                if !hasFile(fs, keyName) {
                    return nil, nil, fmt.Errorf("Missing key %s for certificate %s", keyName, certName)
                }
                cert, err := tls.LoadX509KeyPair(path.Join(hostDir, certName), path.Join(hostDir, keyName))
                if err != nil {
                    return nil, nil, err
                }
                certs = append(certs, &cert)
            }
            if strings.HasSuffix(f.Name(), ".key") {
                keyName := f.Name()
                certName := keyName[:len(keyName)-4] + ".cert"
                log.Debugf("key: %s", hostDir+"/"+f.Name())
                if !hasFile(fs, certName) {
                    return nil, nil, fmt.Errorf("Missing certificate %s for key %s", certName, keyName)
                }
            }
        }
    }

    if len(certs) == 0 {
        client := newClient(jar, pool, nil, timeout, secure)
        res, err := client.Do(req)
        if err != nil {
            return nil, nil, err
        }
        return res, client, nil
    }

    for i, cert := range certs {
        client := newClient(jar, pool, cert, timeout, secure)
        res, err := client.Do(req)
        // If this is the last cert, otherwise, continue to next cert if 403 or 5xx
        if i == len(certs)-1 || err == nil && res.StatusCode != 403 && res.StatusCode < 500 {
            return res, client, err
        }
    }

    return nil, nil, nil
}