How to use a private Docker registry: from install to login, push, and certificates

docker push returns denied, or docker pull fails with x509—usually the image is fine and the registry...