Error response from daemon: Get "https://registry.example.com/v2/": x509: certificate signed by unknown authority

Common causes

• A private registry uses a certificate from an internal CA or a self-signed certificate.
• A corporate proxy re-signs HTTPS traffic to Docker Hub or other registries.
• The registry does not send its intermediate certificate.

How to fix it

1. Trust the CA for that registry: place it at /etc/docker/certs.d/registry.example.com:5000/ca.crt (the port is part of the folder name if used).
2. Or add the CA to the host trust store (update-ca-certificates) and restart Docker; on Docker Desktop, add it to the OS keychain or certificate store.
3. Serve the full chain from the registry. Avoid insecure-registries, which disables verification.