下载镜像如返回如下信息：
Get https://registry-1.docker.io/v2/: x509: certificate is valid for pss-cep-authtoken.asurionmobile.com, pss-cep-campaignrest.asurionmobile.com, pss-cep-campauto.asurionmobile.com, pss-cep-campaignweb.asurionmobile.com, pss-cep-criterialoader.asurionmobile.com, pss-cep-csvloader.asurionmobile.com, pss-cep-datalookupservice.asurionmobile.com, pss-cep-dbmigrationapi.asurionmobile.com, pss-cep-deviceregister.asurionmobile.com, pss-cep-dynamicdataapi.asurionmobile.com, pss-cep-enrollmentfeedprocesor.asurionmobile.com, pss-cep-eventforapi.asurionmobile.com, pss-cep-gatewayapi.asurionmobile.com, pss-cep-history-api.asurionmobile.com, pss-cep-jobreader.asurionmobile.com, pss-cep-notificationapi.asurionmobile.com, pss-cep-preferencesapi.asurionmobile.com, pss-cep-refloader.asurionmobile.com, pss-cep-servertemplateprocessor.asurionmobile.com, pss-cep-ssloader.asurionmobile.com, pss-cep-schedulerapi.asurionmobile.com, pss-cep-smsgatewayapi.asurionmobile.com, pss-dis-supportviewapi.asurionmobile.com, not registry-1.docker.io
解决办法：
openssl genrsa -out client.key 4096
openssl req -new -x509 -text -key client.key -out client.key
mv client.* /usr/local/share/ca-certificate
systemctl restart docker
前端时间更新了openssl，可能是这个原因导致的，具体原因以后再分析。
原文：https://www.cnblogs.com/cpw6/p/12167902.html