CentOS Stream 9 – Common Problem 042 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

podman pull from internal registry returns x509 certificate signed by unknown authority.

Environment & Reproduction

CI runners pulling from corporate Harbor or Quay on CentOS Stream 9.

cat /etc/os-release
uname -r
rpm -qa | grep 

Root Cause Analysis

Internal CA not added to system trust store.

Quick Triage

Confirm package, network, SELinux and firewall state.

podman pull registry.example/app:1 2>&1 | tail
trust list | grep -i internal

Step-by-Step Diagnosis

Drill into container/registry state and recent journal entries to isolate the failure.

openssl s_client -connect registry.example:443 -showcerts </dev/null

Solution – Primary Fix

Apply the standard remediation for container/registry on CentOS Stream 9.

sudo cp internal-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust
podman pull registry.example/app:1

Solution – Alternative Approaches

Configure registries.conf insecure=true only for isolated test labs.

Verification & Acceptance Criteria

Validate the fix with positive functional checks before closing.

podman pull registry.example/app:1

Rollback Plan

Revert to the previous known-good configuration if the fix regresses.

sudo rm /etc/pki/ca-trust/source/anchors/internal-ca.crt
sudo update-ca-trust

Prevention & Hardening

Codify the fix in configuration management and add monitoring.

Distribute CA via Ansible and verify with openssl in CI.

Related Errors & Cross-Refs

Skopeo TLS errors and Quadlet pull failures.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

containers-registries.conf(5).