why x509: certificate signed by unknown authority

[l1douhua]

[root@k8s-control-plane-01 certs.d]# nerdctl login https://douhua.com:30003
Enter Username: admin
Enter Password:
ERRO[0006] failed to call tryLoginWithRegHost error="failed to call rh.Client.Do: Get "https://douhua.com:30003/v2/\": x509: certificate signed by unknown authority" i=0
FATA[0006] failed to call rh.Client.Do: Get "https://douhua.com:30003/v2/": x509: certificate signed by unknown authority

how do i solve this problem

[fahedouch]

https://github.com/containerd/nerdctl/blob/main/docs/faq.md#how-to-specify-the-ca-certificate-of-the-registry

[l1douhua]

server = "https://douhua.com:30003"
[host."https://douhua.com:30003"]
ca = "/root/baga/ca.crt"

not solved

[fahedouch]

in which path ? rootfull or rootless ?
did you restarted containerd ?

[l1douhua]

yes

[l1douhua]

/etc/containerd/certs.d/douhua.com:30003