Docker manifest won't authenticate if TLS is not terminated by registry

Description

I have a setup where nginx is sitting as the front-end web server and is reverse proxying for Docker registry. Apparently this kind of setup confuses the docker CLI to not send the authentication headers when creating a manifest list on the registry, because the registry server is oblivious about TLS.

Steps to reproduce the issue:

1. Set up nginx (with TLS) and a docker registry behind it
2. Push an image (registry.address/image_name) to the registry
3. Run docker manifest create registry.address/manifest_name registry.address/image_name

Describe the results you received:

no such manifest: registry.address/image_name
Pulling registry.address/image_name works fine however!

Describe the results you expected:

The manifest list being created on the registry.

Additional information you deem important (e.g. issue happens only occasionally):

Output of docker version:

Client:
 Version:	18.03.0-ce
 API version:	1.37
 Go version:	go1.9.4
 Git commit:	0520e24
 Built:	Wed Mar 21 23:10:01 2018
 OS/Arch:	linux/amd64
 Experimental:	true
 Orchestrator:	swarm

Server:
 Engine:
  Version:	18.03.0-ce
  API version:	1.37 (minimum version 1.12)
  Go version:	go1.9.4
  Git commit:	0520e24
  Built:	Wed Mar 21 23:08:31 2018
  OS/Arch:	linux/amd64
  Experimental:	true

Output of docker info:

Containers: 10
 Running: 10
 Paused: 0
 Stopped: 0
Images: 472
Server Version: 18.03.0-ce
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 414
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: cfd04396dc68220d1cecbe686a6cc3aa5ce3667c
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: 949e6fa
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-119-generic
Operating System: Ubuntu 16.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 6.795GiB
Name: devib
ID: YWI7:LAUS:45DD:ZOTC:IVL6:N4DK:CBFR:QJ5I:GWDC:TFCE:JMGH:BOMQ
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: true
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):

This is on an Azure VM.
Nginx configuration for the registry:

server {
    listen 443 ssl http2;
    server_name redacted.example.org;
    access_log /var/log/nginx/registry-access.log;
    error_log /var/log/nginx/registry-error.log notice;

    # Allow large enough uploads
    client_max_body_size 0;

    location / {
        proxy_pass http://localhost:5000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        auth_basic "Registry realm";
        auth_basic_user_file /etc/docker-registry-htpasswd;
    }
}

Start at the docker manifest create entry point and trace how it retrieves the referenced image manifest and handles registry authentication through an nginx TLS reverse proxy. Reproduce the listed setup and compare manifest creation with the working pull operation; done means the manifest list is created successfully when TLS terminates at nginx.