Windows Server 2016 – Container host cannot pull images behind TLS-inspecting proxy – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Container deployment pipelines fail because base images cannot be retrieved from registries.

Environment & Reproduction

Observed where outbound HTTPS passes through SSL inspection without trusted interception CA.

docker pull mcr.microsoft.com/windows/servercore:ltsc2019
netsh winhttp show proxy

Root Cause Analysis

TLS handshake fails because Docker engine does not trust proxy-issued certificates.

Quick Triage

Verify proxy settings for LocalSystem context and trusted root certificate presence.

Get-ChildItem Cert:LocalMachineRoot | ? {$_.Subject -match ''}

Step-by-Step Diagnosis

Inspect daemon logs and certificate chain trust.

Get-EventLog -LogName Application -Newest 200 | ? {$_.Source -match 'docker'}
certutil -store root

Solution – Primary Fix

Install proxy root CA and configure daemon proxy environment.

Import-Certificate -FilePath C:Tempproxy-root.cer -CertStoreLocation Cert:LocalMachineRoot
Restart-Service docker

Solution – Alternative Approaches

Use registry mirror in trusted network segment to avoid direct inspected egress.

Verification & Acceptance Criteria

Required container images pull successfully and deployment job completes.

Rollback Plan

Remove temporary proxy overrides and revert to previous daemon config if regressions appear.

Prevention & Hardening

Include certificate trust validation in all proxy change procedures.

Related Errors & Cross-Refs

Can overlap with WinHTTP proxy mismatch and expired enterprise root CAs.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: Windows containers networking and Docker engine proxy configuration.